added helmet for hardening the api (#115)

added helmet for hardening the api
kadaster-labs · Jun 29, 2021 · cf75b80 · cf75b80
1 parent 3b73c86
commit cf75b80
Show file tree

Hide file tree

Showing 3 changed files with 10 additions and 0 deletions.
diff --git a/package-lock.json b/package-lock.json
diff --git a/package.json b/package.json
@@ -40,6 +40,7 @@
     "class-validator": "^0.12.2",
     "cookie-parser": "^1.4.5",
     "geteventstore-promise": "^3.2.4",
+    "helmet": "^4.6.0",
     "jwks-rsa": "^1.12.3",
     "migrate-mongo": "^8.1.4",
     "moment": "^2.26.0",

diff --git a/src/main.ts b/src/main.ts
@@ -3,15 +3,19 @@ import { NestFactory } from '@nestjs/core';
 import { ValidationPipe } from '@nestjs/common';
 import { SwaggerModule, DocumentBuilder } from '@nestjs/swagger';
 import { DomainExceptionFilter } from './core/errors/domain-exception.filter';
+import * as helmet from 'helmet';
 
 async function bootstrap() {
   const port = process.env.PORT || 3000;
   const app = await NestFactory.create(AppModule, {
     logger: ['error', 'warn'],
   });
+  // WARNING the order matters because of the underlying platform !!
+  app.use(helmet());
   app.enableCors();
   app.useGlobalPipes(new ValidationPipe());
   app.useGlobalFilters(new DomainExceptionFilter());
+
   app.setGlobalPrefix('api');
 
   const documentOptions = new DocumentBuilder()