{"id":24973398,"url":"https://github.com/reside-eng/fortifyjs","last_synced_at":"2026-04-08T02:03:25.543Z","repository":{"id":37050320,"uuid":"442570014","full_name":"reside-eng/fortifyjs","owner":"reside-eng","description":"FortifyJS is a library focused on delivering security headers for web applications within the JavaScript ecosystem","archived":false,"fork":false,"pushed_at":"2026-03-19T22:18:39.000Z","size":15941,"stargazers_count":0,"open_issues_count":2,"forks_count":1,"subscribers_count":9,"default_branch":"main","last_synced_at":"2026-03-20T13:25:22.610Z","etag":null,"topics":["clickjacking","content-security-policy","cross-site-scripting","fortified","headers","http","javascript","security","web"],"latest_commit_sha":null,"homepage":"","language":"TypeScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/reside-eng.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":"CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":".github/CODEOWNERS","security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2021-12-28T19:57:32.000Z","updated_at":"2026-03-19T18:51:10.000Z","dependencies_parsed_at":"2023-12-16T02:29:07.005Z","dependency_job_id":"ca59f402-a593-42be-85b4-8679ee8184c7","html_url":"https://github.com/reside-eng/fortifyjs","commit_stats":{"total_commits":317,"total_committers":6,"mean_commits":"52.833333333333336","dds":"0.16403785488958988","last_synced_commit":"7f08e1472203383e114c57d291befdc20b75de0b"},"previous_names":[],"tags_count":17,"template":false,"template_full_name":null,"purl":"pkg:github/reside-eng/fortifyjs","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/reside-eng%2Ffortifyjs","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/reside-eng%2Ffortifyjs/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/reside-eng%2Ffortifyjs/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/reside-eng%2Ffortifyjs/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/reside-eng","download_url":"https://codeload.github.com/reside-eng/fortifyjs/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/reside-eng%2Ffortifyjs/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":31536473,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-04-07T16:28:08.000Z","status":"online","status_checked_at":"2026-04-08T02:00:06.127Z","response_time":54,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["clickjacking","content-security-policy","cross-site-scripting","fortified","headers","http","javascript","security","web"],"created_at":"2025-02-03T18:59:13.823Z","updated_at":"2026-04-08T02:03:25.500Z","avatar_url":"https://github.com/reside-eng.png","language":"TypeScript","readme":"\u003cdiv align=\"center\"\u003e\n    \u003ch1\u003e@side/fortifyjs\u003c/h1\u003e\n    \u003cdiv\u003eA platform-agnostic library for generating security headers for your web application.\u003c/div\u003e\n    \u003c/br\u003e\n\u003c/div\u003e\n\n\u003cdiv align=\"center\"\u003e\n\n[![NPM version][npm-image]][npm-url]\n[![License][license-image]][license-url]\n[![Build Status][build-status-image]][build-status-url]\n[![Coverage Status][coverage-image]][coverage-url]\n[![semantic-release][semantic-release-icon]][semantic-release-url]\n[![Code Style][code-style-image]][code-style-url]\n\n\u003c/div\u003e\n\n## Getting Started\n\nModern web applications don't just need a helmet; they need a fortress. FortifyJS is just that, the walls to gate client and server-side requests in a world where attackers can manipulate the browser in many ways to break into your web application and steal information of trade secrets.\n\nWhile [helmet.js](https://helmetjs.github.io/) is useful for [express](https://expressjs.com/) applications, in a world of alternatives to express popping up and different ways of writing JavaScript applications on the rise, there needs to be an alternative that abstracts the production of valid security headers out of our modern applications. FortifyJS exists in this niche. FortifyJS is solely responsible for providing a representation that is useful in setting headers in consumer applications. FortifyJS takes control of the headers; you take over and implement them in your application.\n\nFortifyJS also differs in that it seeks to provide a comprehensive set of security headers to form a default posture for any application.\n\n### Installation\n\nInstall through your package manager within an existing project:\n\n```bash\nyarn add @side/fortifyjs\n```\n\n### How-to\n\nFortifyJS exports one function: `fortifyHeaders`. FortifyJS takes an object literal with properties that match each supported security header. This function returns an object mapping ths string header name (e.g. `X-Content-Type-Options`) to a value (e.g. `nosniff`).\n\nThe current default configuration can be expressed like this:\n\n```javascript\nimport { fortifyHeaders, FortifySettings } from '@side/fortifyjs';\n\nconst headers = fortifyHeaders({\n  xContentTypeOptions: {\n    nosniff: true,\n  },\n  contentSecurityPolicy: {\n    defaultSrc: [\"'self'\"],\n    baseUri: [\"'self'\"],\n    fontSrc: [\"'self'\", 'https:', 'data:'],\n    frameAncestors: [\"'self'\"],\n    imgSrc: [\"'self'\", \"'data:'\"],\n    objectSrc: [\"'none'\"],\n    scriptSrc: [\"'self'\"],\n    scriptSrcAttr: [\"'none'\"],\n    styleSrc: [\"'self'\", \"'https:'\", \"'unsafe-inline'\"],\n    upgradeInsecureRequests: true,\n  },\n  crossOriginEmbedderPolicy: {\n    requireCorp: true,\n  },\n  crossOriginOpenerPolicy: {\n    sameOrigin: true,\n  },\n  crossOriginResourcePolicy: {\n    sameOrigin: true,\n  },\n  expectCt: {\n    maxAge: 0,\n  },\n  originAgentCluster: {\n    enable: true,\n  },\n  referrerPolicy: {\n    noReferrer: true,\n  },\n  strictTransportSecurity: {\n    maxAge: 31536000,\n  },\n  xContentTypeOptions: {\n    noSniff: true,\n  },\n  xDnsPrefetchControl: {\n    off: true,\n  },\n  xDownloadOptions: {\n    noopen: true,\n  },\n  xFrameOptions: {\n    sameOrigin: true,\n  },\n  xPermittedCrossDomainPolicies: {\n    none: true,\n  },\n});\n\n/** @type {FortifySettings} */\nconsole.log(headers);\n/*\n * {\n      'Content-Security-Policy':\n        \"default-src 'self'; base-uri 'self'; font-src 'self' https: data:; frame-ancestors 'self'; img-src 'self' data:; object-src 'none'; script-src 'self'; script-src-attr 'none'; style-src 'self' https: 'unsafe-inline'; upgrade-insecure-requests\",\n      'Cross-Origin-Embedder-Policy': 'require-corp',\n      'Cross-Origin-Opener-Policy': 'same-origin',\n      'Cross-Origin-Resource-Policy': 'same-origin',\n      'Expect-Ct': 'max-age=0',\n      'Origin-Agent-Cluster': '?1',\n      'Referrer-Policy': 'no-referrer',\n      'Strict-Transport-Security': 'max-age=15552000',\n      'X-Content-Type-Options': 'nosniff',\n      'X-Dns-Prefetch-Control': 'off',\n      'X-Download-Options': 'noopen',\n      'X-Frame-Options': 'SAMEORIGIN',\n      'X-Permitted-Cross-Domain-Policies': 'none',\n    }\n */\n```\n\nYou can choose to use these defaults by setting the fortify header to an empty object. This can be done globally:\n\n```javascript\nimport { fortifyHeaders, FortifySettings } from '@side/fortifyjs';\n\nconst headers = fortifyHeaders();\n\n/** @type {FortifySettings} */\nconsole.log(headers); // same as above\n```\n\nOr, you can choose to pull in individual header default postures:\n\n```javascript\nimport { fortifyHeaders, FortifySettings } from '@side/fortifyjs';\n\nconst headers = fortifyHeaders({\n  contentSecurityPolicy: {},\n});\n\n/** @type {FortifySettings} */\nconsole.log(headers); // same as above\n/*\n * {\n      'Content-Security-Policy':\n        \"default-src 'self'; base-uri 'self'; font-src 'self' https: data:; frame-ancestors 'self'; img-src 'self' data:; object-src 'none'; script-src 'self'; script-src-attr 'none'; style-src 'self' https: 'unsafe-inline'; upgrade-insecure-requests\",\n    }\n */\n```\n\nIf you want to specify a custom header value for one, like `Content-Security-Policy`, but also want to include all of the default headers, then you can use the second parameter to `fortifyHeaders` to tell the header generation that you want to include the rest of the available headers:\n\n```javascript\nimport { fortifyHeaders, FortifySettings } from '@side/fortifyjs';\n\nconst headers = fortifyHeaders(\n  {\n    contentSecurityPolicy: {\n      defaultSrc: [\"'self'\", '*.somedomain.com'],\n    },\n  },\n  { useDefaults: true },\n);\n\n/** @type {FortifySettings} */\nconsole.log(headers); // same as above\n/*\n * {\n      'Content-Security-Policy': \"default-src 'self' *.somedomain.com\",\n      'Cross-Origin-Embedder-Policy': 'require-corp',\n      'Cross-Origin-Opener-Policy': 'same-origin',\n      'Cross-Origin-Resource-Policy': 'same-origin',\n      'Expect-Ct': 'max-age=0',\n      'Origin-Agent-Cluster': '?1',\n      'Referrer-Policy': 'no-referrer',\n      'Strict-Transport-Security': 'max-age=15552000',\n      'X-Content-Type-Options': 'nosniff',\n      'X-Dns-Prefetch-Control': 'off',\n      'X-Download-Options': 'noopen',\n      'X-Frame-Options': 'SAMEORIGIN',\n      'X-Permitted-Cross-Domain-Policies': 'none',\n    }\n */\n```\n\nYou can then use this object to integrate within the platform of your choice: `next`, `fastify`, etc.\n\n## Header Inclusion Strategy\n\nThe strategy for this problem is building a lib that can be consumed by packages that integrate with these different providers: `next`, `fastify`, etc.\n\nSince this library is specifically for delivering the relevant headers to secure modern web applications, it not contain information about `X-Powered-By`. This header is typically removed completely. FortifyJS only provides ones that ought to be _included_, not _excluded_. This should be handled at the consumer-level in whichever platform you're integrating the security headers into.\n\n### Supported Headers\n\n| Header Name                       | Default Value                                                                                                                                                                                                                                     | Details                                       |\n| --------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------- |\n| Content-Security-Policy           | default-src 'self'; base-uri 'self'; font-src 'self' https: data:; frame-ancestors 'self'; img-src 'self' data:; object-src 'none'; script-src 'self'; script-src-attr 'none'; style-src 'self' https: 'unsafe-inline'; upgrade-insecure-requests | [Link][content-security-policy-url]           |\n| Cross-Origin-Embedder-Policy      | require-corp                                                                                                                                                                                                                                      | [Link][cross-origin-embedder-policy-url]      |\n| Cross-Origin-Opener-Policy        | same-origin                                                                                                                                                                                                                                       | [Link][cross-origin-opener-policy-url]        |\n| Cross-Origin-Resource-Policy      | same-origin                                                                                                                                                                                                                                       | [Link][cross-origin-resource-policy-url]      |\n| Expect-Ct                         | max-age=0                                                                                                                                                                                                                                         | [Link][expect-ct-url]                         |\n| Origin-Agent-Cluster              | ?1                                                                                                                                                                                                                                                | [Link][origin-agent-cluster-url]              |\n| Referrer-Policy                   | no-referrer                                                                                                                                                                                                                                       | [Link][referrer-policy-url]                   |\n| Strict-Transport-Security         | max-age=15552000                                                                                                                                                                                                                                  | [Link][strict-transport-security-url]         |\n| X-Content-Type-Options            | nosniff                                                                                                                                                                                                                                           | [Link][x-content-type-options-url]            |\n| X-Dns-Prefetch-Control            | off                                                                                                                                                                                                                                               | [Link][x-dns-prefetch-control-url]            |\n| X-Download-Options                | noopen                                                                                                                                                                                                                                            | [Link][x-download-options-url]                |\n| X-Frame-Options                   | SAMEORIGIN                                                                                                                                                                                                                                        | [Link][x-frame-options-url]                   |\n| X-Permitted-Cross-Domain-Policies | none                                                                                                                                                                                                                                              | [Link][x-permitted-cross-domain-policies-url] |\n\n### Contributing Policy\n\nThe development team at Side is currently investigating the best expression of Codes of Conduct and Contributing Guidelines to fit our culture and values. FortifyJS is a Free and Open Source software solution that is licensed under MIT. If you desire to contribute to extend the functionality or address an issue, please maintain professional communication practices. That alone goes a long way toward effective collaboration and benefiting the community at large!\n\n[content-security-policy-url]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy\n[cross-origin-embedder-policy-url]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cross-Origin-Embedder-Policy\n[cross-origin-opener-policy-url]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cross-Origin-Opener-Policy\n[cross-origin-resource-policy-url]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cross-Origin-Resource-Policy\n[expect-ct-url]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Expect-CT\n[origin-agent-cluster-url]: https://web.dev/origin-agent-cluster/\n[referrer-policy-url]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy\n[strict-transport-security-url]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security\n[x-content-type-options-url]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Content-Type-Options\n[x-dns-prefetch-control-url]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-DNS-Prefetch-Control\n[x-download-options-url]: https://www.nwebsec.com/HttpHeaders/SecurityHeaders/XDownloadOptions#:~:text=The%20X%2DDownload%2DOptions%20is,context%20of%20the%20web%20site.\n[x-frame-options-url]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options\n[x-permitted-cross-domain-policies-url]: https://www.scip.ch/en/?labs.20180308\n[npm-image]: https://img.shields.io/npm/v/@side/fortifyjs.svg?style=flat-square\n[npm-url]: https://npmjs.org/package/@side/fortifyjs\n[build-status-image]: https://img.shields.io/github/workflow/status/reside-eng/fortifyjs/Release?style=flat-square\n[build-status-url]: https://github.com/reside-eng/fortifyjs/actions\n[license-image]: https://img.shields.io/npm/l/@side/fortifyjs.svg?style=flat-square\n[license-url]: https://github.com/reside-eng/fortifyjs/blob/main/LICENSE\n[code-style-image]: https://img.shields.io/badge/code%20style-airbnb-blue.svg?style=flat-square\n[code-style-url]: https://github.com/airbnb/javascript\n[semantic-release-icon]: https://img.shields.io/badge/%20%20%F0%9F%93%A6%F0%9F%9A%80-semantic--release-e10079.svg?style=flat-square\n[semantic-release-url]: https://github.com/semantic-release/semantic-release\n[coverage-image]: https://img.shields.io/coveralls/github/reside-eng/fortifyjs?style=flat-square\n[coverage-url]: https://coveralls.io/github/reside-eng/fortifyjs?branch=main\n","funding_links":[],"categories":[],"sub_categories":[],"project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Freside-eng%2Ffortifyjs","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Freside-eng%2Ffortifyjs","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Freside-eng%2Ffortifyjs/lists"}