SS-FCSC/fcsc_ipi_backend
5
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

HSTS issue

Browse Source
This commit is contained in:
Gowtham M 2025-12-18 15:58:21 +05:30
parent c90809b6ce
commit e511d1fbb8
1 changed files with 13 additions and 38 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

51
server.js
View File

@ -13,14 +13,22 @@ require("dotenv").config();
const app = express(); const app = express();
// REQUIRED for HSTS when behind proxy (AWS ALB / Nginx / Cloudflare)
app.set("trust proxy", 1);
const isLocal = process.env.NODE_ENV === "development";
// GLOBAL MIDDLEWARE (body parsing) // GLOBAL MIDDLEWARE (body parsing)
app.use(express.json()); app.use(express.json());
app.use(cookieParser()); app.use(cookieParser());
// HELMET
app.use( app.use(
helmet({ helmet({
contentSecurityPolicy: false, contentSecurityPolicy: false,
}) })
); );
// prevent framing (clickjacking protection) // prevent framing (clickjacking protection)
app.use( app.use(
helmet.frameguard({ helmet.frameguard({
@ -28,26 +36,20 @@ app.use(
}) })
); );
// Add HSTS explicitly (fixes scanner warning) //HSTS (ENABLE FOR UAT + PROD)
if (process.env.NODE_ENV === "production") { if (!isLocal) {
app.use( app.use(
helmet.hsts({ helmet.hsts({
maxAge: 31536000, // 1 year maxAge: 31536000, // 1 year
includeSubDomains: true, includeSubDomains: true,
preload: true, preload: true,
}) })
); );
} }
app.use(morgan("dev")); app.use(morgan("dev"));
app.use(sanitizeInput); app.use(sanitizeInput);
// app.use(cors());
// const allowedOrigins = [
// "http://localhost:5173", //local
// "http://13.201.47.205:5173", //dev
// "http://13.201.47.205:5175", //uat
// "https://ipi.venbait.in/api" // backend
// ];
const allowedOrigins = process.env.ALLOWED_ORIGINS const allowedOrigins = process.env.ALLOWED_ORIGINS
? process.env.ALLOWED_ORIGINS.split(",").map(origin => origin.trim()) ? process.env.ALLOWED_ORIGINS.split(",").map(origin => origin.trim())
: []; : [];
@ -83,34 +85,7 @@ app.use((req, res, next) => {
// // Swagger setup
// const swaggerOptions = {
// definition: {
// openapi: "3.0.0",
// info: {
// title: "FCSC IPI Survey",
// version: "1.0.0",
// description: "Federal Competitiveness and Statistics Centre (FCSC) - Industrial Production Index (IPI)",
// },
// components: {
// securitySchemes: {
// bearerAuth: {
// type: "http",
// scheme: "bearer",
// bearerFormat: "JWT",
// },
// },
// },
// security: [
// {
// bearerAuth: [],
// },
// ],
// },
// apis: ["./app/routes/*.js"],
// };
// const swaggerDocs = swaggerJsdoc(swaggerOptions);
// app.use("/api-docs", swaggerUi.serve, swaggerUi.setup(swaggerDocs));
// Swagger setup // Swagger setup
const swaggerOptions = { const swaggerOptions = {
definition: { definition: {