diff --git a/types/helmet/helmet-tests.ts b/types/helmet/helmet-tests.ts index 39414a7d5f..c028faefa0 100644 --- a/types/helmet/helmet-tests.ts +++ b/types/helmet/helmet-tests.ts @@ -18,6 +18,16 @@ function helmetTest() { action: 'deny' } })); + app.use(helmet({ + featurePolicy: { + features: { + fullscreen: ["'self'"], + vibrate: ["'none'"], + payment: ['example.com'], + syncXhr: ["'none'"] + } + } + })) } /** @@ -244,3 +254,18 @@ function permittedCrossDomainPoliciesTest() { app.use(helmet.permittedCrossDomainPolicies({})); app.use(helmet.permittedCrossDomainPolicies({ permittedPolicies: 'none' })); } + +/** + * @summary Test for {@see helmet#featurePolicy} function. + */ +function featurePolicyTest() { + app.use(helmet.featurePolicy({ + features: { + fullscreen: ["'self'"], + vibrate: ["'none'"], + payment: ['example.com'], + syncXhr: ["'none'"] + } + })); +} + diff --git a/types/helmet/index.d.ts b/types/helmet/index.d.ts index cc1ef2f8bf..3850fc3593 100644 --- a/types/helmet/index.d.ts +++ b/types/helmet/index.d.ts @@ -13,6 +13,7 @@ declare namespace helmet { export interface IHelmetConfiguration { contentSecurityPolicy?: boolean | IHelmetContentSecurityPolicyConfiguration; dnsPrefetchControl?: boolean | IHelmetDnsPrefetchControlConfiguration; + featurePolicy?: IFeaturePolicyOptions; frameguard?: boolean | IHelmetFrameguardConfiguration; hidePoweredBy?: boolean | IHelmetHidePoweredByConfiguration; hpkp?: boolean | IHelmetHpkpConfiguration; @@ -26,6 +27,12 @@ declare namespace helmet { permittedCrossDomainPolicies?: boolean | IHelmetPermittedCrossDomainPoliciesConfiguration; } + export interface IFeaturePolicyOptions { + features: { + [featureName: string]: string[]; + }; + } + export interface IHelmetPermittedCrossDomainPoliciesConfiguration { permittedPolicies?: string; } @@ -196,6 +203,13 @@ declare namespace helmet { */ dnsPrefetchControl(options?: IHelmetDnsPrefetchControlConfiguration): express.RequestHandler; + /** + * @summary Restrict which browser features can be used + * @param {IFeaturePolicyOptions} options The options + * @return {RequestHandler} The Request handler + */ + featurePolicy(options: IFeaturePolicyOptions): express.RequestHandler; + /** * @summary Prevent clickjacking. * @param {IHelmetFrameguardConfiguration} options The options