Skip to content

Allow customization of hapi route options #137

Description

@abillingsley

For security reasons, I would like the swagger ui to include a content security policy. To do this we can use a hapi plugin called blankie.

The following is a plugin configuration and is applied globally to all routes

{
    plugin: require("blankie"),
    options: {
      fontSrc: ["self", "fonts.gstatic.com", "data:"],
      styleSrc: ["self", "fonts.googleapis.com", "unsafe-inline"],
      scriptSrc: ["self", "unsafe-inline"],
      imgSrc: ["self", "data:"],
      generateNonces: false,
    },
  }

Rather than applying this configuration globally I would like to configure the blankie plugin at the route level so the content security policy is defined as strictly as possible

This is achievable in the hapi ecosystem by the plugins route option

{
   ...
   plugins: {
      blankie: {
        fontSrc: ["self", "fonts.gstatic.com", "data:"],
        styleSrc: ["self", "fonts.googleapis.com", "unsafe-inline"],
        scriptSrc: ["self", "unsafe-inline"],
        imgSrc: ["self", "data:"],
        generateNonces: false,
      }
   },
}

it would be ideal if the hapi-swaggered-ui plugin options exposed a mechanism to control the route options

for example

{
    plugin: require("hapi-swaggered-ui"),
    options: {
      title: "My Documentation",
      path: "/documentation",
      swaggerOptions: {
        docExpansion: "list",
      },
      routeOptions: {
        ...anyOtherValidRouteOptions
        plugins: {
          blankie: {
            fontSrc: ["self", "fonts.gstatic.com", "data:"],
            styleSrc: ["self", "fonts.googleapis.com", "unsafe-inline"],
            scriptSrc: ["self", "unsafe-inline"],
            imgSrc: ["self", "data:"],
            generateNonces: false,
          }
        },
      },
    },
  }

This would not only enable my specific use case about control route specific plugins but would also allow any other customization of the route configuration that users of this plugin may desire.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions