dlferro / nuxt-security

🛡 Security Module for Nuxt based on OWASP Top 10 and Helmet

nuxt-security

Security module for Nuxt based on OWASP Top 10 and helmet that adds security response headers, protection middlewares, CORS, and more.

• 📖  Read the documentation
• 👾  Playground
• ✨  Intro video

Features

• Nuxt 3 ready
• Security response headers
• Content Security Policy (CSP) for SSG apps
• Request Size & Rate Limiters
• Cross Site Scripting (XSS) Validation
• Cross-Origin Resource Sharing (CORS) support
• [Optional] Allowed HTTP Methods, Basic Auth, CSRF

Usage

Install the module:

npm i -D nuxt-security
yarn add -D nuxt-security
pnpm add -D nuxt-security

Add the module in the modules array in nuxt.config.ts:

export default defineNuxtConfig({
  modules: ["nuxt-security"],
})

And that's it! The module will now register route rules and server middlewares globally so that your application will be more secured.

Static site generation (SSG)

This module is meant to work with SSR apps, but you can also use this module in SSG apps where you will get a Content Security Policy (CSP) support via <meta http-equiv> tag. You can find more about configuring Content Security Policy (CSP) here.

Configuration

You can pass configuration to the module in the nuxt.config.ts like following:

export default defineNuxtConfig({
  modules: ["nuxt-security"],
  security: {
    // options
  }
})

For all available configuration options check out the docs.

Development

• Run yarn dev:prepare to generate type stubs.
• Use yarn dev to start playground in development mode.

License

MIT License