π‘ Automatically configure your app to follow OWASP security patterns and principles by using HTTP Headers and Middleware
1.0.0 is the stable release
After five release candidate versions, we are now ready to present you a stable 1.0.0 release of NuxtSecurity. We have spent a lot of time trying to stabilise the API while constantly improving the security by implementing features like:
From this point I would like to thank @vejja who did an amazing work delivering a lot of functionalities mentioned both above and below. You are a magician! π
And also, huge kudos to all contributors π
We have tried our best not to include significant breaking changes in the recent stable 1.0.0 version but some changes were necessary to improve quality of the module. Don't worry, we have prepared a migration guide with all the changes and how you should approach when migrating your current application to be up to date with 1.0.0 :)
alllowedMethodsRestricter
In the previous version, alllowedMethodsRestricter
was an array of HTTP methods or '*'
for all methods.
export default defineNuxtConfig({
security: {
allowedMethodsRestricter: ['GET']
}
}
Now it is configured like following:
export default defineNuxtConfig({
security: {
allowedMethodsRestricter: {
methods: ['GET'],
throwError?: true,
}
}
}
This change allows to pass a throwError
property that can be useful to return an error response rather than throwing a default Nuxt error.
permissionsPolicy
In the previous version, if you wanted to disable certain API like camera you would do something like this:
export default defineNuxtConfig({
security: {
headers: {
permissionsPolicy: {
'camera': [()]
},
},
},
})
Now it is configured like following:
export default defineNuxtConfig({
security: {
headers: {
permissionsPolicy: {
'camera': [] // This will block usage of camera by this website
},
},
},
})
This change allows to fix an issue of passing several directives mentioned in #194
interval
in rateLimiter
In the previous version, if you wanted to set the interval for your rateLimiter you would do something like this:
export default defineNuxtConfig({
security: {
rateLimiter: {
interval: 'hour' | 60000
}
}
})
Now it is configured like following:
export default defineNuxtConfig({
security: {
rateLimiter: {
interval: 60000
}
}
})
This change was required to migrate to an updated rateLimiter that supports modern examples.
In the previous version, nonce
could be either an object with a type NonceOptions
or false
.
export type NonceOptions = {
enabled: boolean;
mode?: 'renew' | 'check';
value?: (() => string);
}
Now it is only a boolean value:
export default defineNuxtConfig({
security: {
nonce: true | false
}
}
This change was necessary to resolve security vulnerability for nonce reported by vejja https://github.com/Baroshem/nuxt-security/pull/257. Read more about the new usage of nonce in this module https://nuxt-security.vercel.app/documentation/headers/csp#nonce
In this version, we have updated ContentSecurityConfiguration by a mile, specifically we have enabled strict CSP by default to spread good security practices.
If you are experiencing some issues with CSP, check out the new documentation about it:
This PR introduces per-route configuration of security headers, via
defineNuxtConfig({
routeRules: {
[some-route]: {
security: {
headers : ...
}
}
}
})
This is the last release candidate version. In the next weeks we are planning to release stable 1.0.0 version :)
π Changelog compare changes
credentialless
value to Cross-Origin-Embedder-Policy
headernonce
(#213)nonce
option is set to true
interval
propertynonce
by @trijpstra-fourlights in https://github.com/Baroshem/nuxt-security/pull/213
nonce
docs about unsafe-inline
during development by @trijpstra-fourlights in https://github.com/Baroshem/nuxt-security/pull/240
false
by @dargmuesli in https://github.com/Baroshem/nuxt-security/pull/286
false
with boolean
by @Mohamed-Kaizen in https://github.com/Baroshem/nuxt-security/pull/284
1.0.0-rc.5 is the next release candidate
This PR introduces per-route configuration of security headers, via
defineNuxtConfig({
routeRules: {
[some-route]: {
security: {
headers : ...
}
}
}
})
This is the last release candidate version. In the next weeks we are planning to release stable 1.0.0 version :)
π Changelog compare changes
1.0.0-rc.4 is the next release candidate
We are planning to release one or two more release candidate versions before a stable 1.0.0 version will be released.
This version may include β οΈ breaking changes but don't worry, we have prepared migration guide for you π
In this version, we have updated ContentSecurityConfiguration by a mile, specifically we have enabled strict CSP by default to spread good security practices.
If you are experiencing some issues with CSP, check out the new documentation about it:
π Changelog compare changes
1.0.0-rc.3 is the next release candidate
We are planning to release one or two more release candidate versions with bugfixes before a stable 1.0.0 version will be released.
This version includes β οΈ breaking changes but don't worry, we have prepared migration guide for you π
In the previous version, nonce
could be either an object with a type NonceOptions
or false
.
export type NonceOptions = {
enabled: boolean;
mode?: 'renew' | 'check';
value?: (() => string);
}
Now it is only a boolean value:
export default defineNuxtConfig({
security: {
nonce: true | false
}
}
This change was necessary to resolve security vulnerability for nonce reported by vejja https://github.com/Baroshem/nuxt-security/pull/257. Read more about the new usage of nonce in this module https://nuxt-security.vercel.app/documentation/headers/csp#nonce
π Changelog compare changes
credentialless
value to Cross-Origin-Embedder-Policy
headernonce
option is set to true
interval
property1.0.0-rc.1 is the first release candidate
We are planning to release one or two more release candidate versions with bugfixes before a stable 1.0.0 version will be released.
This version includes β οΈ breaking changes but don't worry, we have prepared migration guide for you π
alllowedMethodsRestricter
In the previous version, alllowedMethodsRestricter
was an array of HTTP methods or '*'
for all methods.
export default defineNuxtConfig({
security: {
allowedMethodsRestricter: ['GET']
}
}
Now it is configured like following:
export default defineNuxtConfig({
security: {
allowedMethodsRestricter: {
methods: ['GET'],
throwError?: true,
}
}
}
This change allows to pass a throwError
property that can be useful to return an error response rather than throwing a default Nuxt error.
permissionsPolicy
In the previous version, if you wanted to disable certain API like camera you would do something like this:
export default defineNuxtConfig({
security: {
headers: {
permissionsPolicy: {
'camera': [()]
},
},
},
})
Now it is configured like following:
export default defineNuxtConfig({
security: {
headers: {
permissionsPolicy: {
'camera': [] // This will block usage of camera by this website
},
},
},
})
This change allows to fix an issue of passing several directives mentioned in #194
interval
in rateLimiter
In the previous version, if you wanted to set the interval for your rateLimiter you would do something like this:
export default defineNuxtConfig({
security: {
rateLimiter: {
interval: 'hour' | 60000
}
}
})
Now it is configured like following:
export default defineNuxtConfig({
security: {
rateLimiter: {
interval: 60000
}
}
})
This change was required to migrate to an updated rateLimiter that supports modern examples.
π Changelog compare changes
nonce
(#213)Full Changelog: https://github.com/Baroshem/nuxt-security/compare/v0.14.2...v0.14.4
Full Changelog: https://github.com/Baroshem/nuxt-security/compare/v0.14.1...v0.14.2
ssr
by @trijpstra-fourlights in https://github.com/Baroshem/nuxt-security/pull/177
Full Changelog: https://github.com/Baroshem/nuxt-security/compare/v0.14.0...v0.14.1
nonce
support to csp by @trijpstra-fourlights in https://github.com/Baroshem/nuxt-security/pull/171
Full Changelog: https://github.com/Baroshem/nuxt-security/compare/v0.13.1...v0.14.0
Full Changelog: https://github.com/Baroshem/nuxt-security/compare/v0.13.0...v0.13.1