fetch-metadata

import express from 'express'; import fetchMetadata from 'fetch-metadata'; const app = express(); const port = 3000; // Apply the fetch-metadata middleware with custom configuration. // It will allow 'same-origin', 'same-site', and 'none' (user interaction) requests. // It will block navigation requests trying to embed 'object' or 'embed' elements. app.use( fetchMetadata({ allowedFetchSites: ['same-origin', 'same-site', 'none'], disallowedNavigationRequests: ['object', 'embed'], errorStatusCode: 403, allowedPaths: [ '/public-data', // Allow access to this path regardless of fetch metadata { path: '/health-check', method: 'GET' } // Allow GET requests to /health-check ], onError: (request, response, next, options) => { console.warn(`[Fetch Metadata] Blocked request to ${request.url} from site ${request.headers['sec-fetch-site'] || 'N/A'}`); response.status(options.errorStatusCode).send('Access Denied: Request blocked by security policy.'); // For testing or specific bypasses, you could call next() here to allow the request: // next(); } }) ); // Define a simple root route app.get('/', (req, res) => { res.send(` <h1>Fetch Metadata Middleware Demo</h1> <p>This server enforces Fetch Metadata Request Headers.</p> <p>Try making requests from different origins or contexts using browser dev tools.</p> <p>A fetch from 'same-origin' to /protected should succeed.</p> <a href="/public-data">Public Data (always allowed)</a><br/> <a href="/health-check">Health Check (GET allowed)</a> <script> fetch('/protected') .then(response => response.text()) .then(text => console.log('GET /protected (same-origin):', text)) .catch(error => console.error('GET /protected (same-origin) failed:', error)); fetch('/public-data') .then(response => response.text()) .then(text => console.log('GET /public-data (allowed path):', text)) .catch(error => console.error('GET /public-data (allowed path) failed:', error)); </script> `); }); // A protected route that relies on fetch metadata policies app.get('/protected', (req, res) => { res.send('You accessed a protected resource (Sec-Fetch-Site: same-origin/same-site/none allowed).'); }); // An explicitly allowed public route via 'allowedPaths' app.get('/public-data', (req, res) => { res.send('This is public data, accessible via allowedPaths config.'); }); // A health check route with a specific method allowed via 'allowedPaths' app.get('/health-check', (req, res) => { res.status(200).send('Service is healthy!'); }); // Start the server app.listen(port, () => { console.log(`Server listening on http://localhost:${port}`); console.log('To test: Open in browser, then try to fetch /protected from a different origin (e.g., using browser console or a separate HTML page on another domain).'); });