Merge pull request zalando-nakadi#138 from zalando-nakadi/update-rule…

…-203

Update API guidelines reference

client/Pages/EventTypeCreate/View.elm

@@ -330,9 +330,9 @@ viewForm model setup =
                         , text " business order that finally leads to the event creation, and"
                         , text " is used e.g. for analytics change data capture, i.e. keeping"
                         , text " transactional data in sync as source for analytics. The"
-                        , text " information is recommended for (external) data change events"
+                        , text " information must be provided for (external) data change events"
                         , text "\u{00A0}-- see "
-                        , externalLink "API/Event Guidelines" "https://opensource.zalando.com/restful-api-guidelines/#203"
+                        , externalLink "API/Event Guidelines" "https://opensource.zalando.com/restful-api-guidelines/#242"
                         , text "."
                         ]
                     ]

package.json

@@ -43,6 +43,7 @@
     "express-http-proxy": "^1.0.2",
     "express-request-id": "^1.4.0",
     "express-winston": "^2.4.0",
+    "helmet": "^4.6.0",
     "node-fetch": "^2.0.0-alpha.8",
     "passport": "^0.4.0",
     "passport-google-oauth": "^1.0.0",

server/App.js

@@ -7,6 +7,7 @@ const os = require('os');
 const express = require('express');
 const sessions = require('client-sessions');
 const bodyParser = require('body-parser');
+const helmet = require('helmet');
 
 const logger = require('./logger');
 const auth = require('./auth');
@@ -28,6 +29,11 @@ const staticFiles = require('./staticFiles');
 module.exports = function App(config) {
 
     const app = express()
+    .use(helmet({
+        frameguard: {
+            action: 'DENY'
+        }
+    }))
     .get('/health', getHealth)
     .use(logger.init)
     .use(sessions(config.cookie))