Support function-based customisation in reply.helmet options

README.md

@@ -100,6 +100,14 @@ fastify.get('/here-we-use-helmet-reply-decorator', async (request, reply) => {
   } else {
     // we apply customized options
     await reply.helmet({ frameguard: false })
+    // You can also pass a function returning customized options.
+    // This is useful for modifying previously set options.
+    // await reply.helmet((opts) => {
+    //   // Here we're adding a new option to a directive without having to
+    //   // replace the entire `contentSecurityPolicy` object.
+    //   opts.contentSecurityPolicy.directives['script-src'].push('"nonce-123abc"');
+    //   return opts
+    // })
   }
 
   return {

index.js

@@ -88,9 +88,13 @@ async function replyDecorators (request, reply, configuration, enableCSP) {
   }
 
   reply.helmet = function (opts) {
-    const helmetConfiguration = opts
-      ? Object.assign(Object.create(null), configuration, opts)
-      : configuration
+    let helmetConfiguration = configuration
+
+    if (typeof opts === 'function') {
+      helmetConfiguration = opts(helmetConfiguration)
+    } else if (opts) {
+      helmetConfiguration = Object.assign(Object.create(null), configuration, opts)
+    }
 
     return helmet(helmetConfiguration)(request.raw, reply.raw, done)
   }
@@ -135,6 +139,7 @@ async function buildHelmetOnRoutes (request, reply, configuration, enableCSP) {
 
 // Helmet forward a typeof Error object so we just need to throw it as is.
 function done (error) {
+  /* c8 ignore next */
   if (error) throw error
 }
 

test/global.test.js

@@ -661,6 +661,55 @@ test('It should be able to pass custom options to the `helmet` reply decorator',
   t.assert.deepStrictEqual(actualResponseHeaders, expected)
 })
 
+test('It should be able to pass custom options as a function to the `helmet` reply decorator', async (t) => {
+  t.plan(4)
+
+  const fastify = Fastify()
+  await fastify.register(helmet, { global: false })
+
+  fastify.get('/', async (_request, reply) => {
+    t.assert.ok(reply.helmet)
+    t.assert.notDeepStrictEqual(reply.helmet, null)
+
+    await reply.helmet((opts) => {
+      opts.frameguard = false
+
+      return opts
+    })
+    return { message: 'ok' }
+  })
+
+  const response = await fastify.inject({
+    method: 'GET',
+    path: '/'
+  })
+
+  const expected = {
+    'x-dns-prefetch-control': 'off',
+    'x-download-options': 'noopen',
+    'x-content-type-options': 'nosniff',
+    'x-xss-protection': '0'
+  }
+
+  const notExpected = {
+    'x-frame-options': 'SAMEORIGIN'
+  }
+
+  const actualResponseHeaders = {
+    'x-dns-prefetch-control': response.headers['x-dns-prefetch-control'],
+    'x-download-options': response.headers['x-download-options'],
+    'x-content-type-options': response.headers['x-content-type-options'],
+    'x-xss-protection': response.headers['x-xss-protection']
+  }
+
+  const actualNotExpectedHeaders = {
+    'x-frame-options': response.headers['x-frame-options']
+  }
+
+  t.assert.notDeepStrictEqual(actualNotExpectedHeaders, notExpected)
+  t.assert.deepStrictEqual(actualResponseHeaders, expected)
+})
+
 test('It should be able to conditionally apply the middlewares through the `helmet` reply decorator', async (t) => {
   t.plan(10)
 

types/index.d.ts

@@ -12,7 +12,7 @@ declare module 'fastify' {
       script: string;
       style: string;
     },
-    helmet: (opts?: HelmetOptions) => typeof helmet
+    helmet: (opts?: HelmetOptions | ((opts: HelmetOptions) => HelmetOptions)) => typeof helmet
   }
 
   export interface RouteOptions extends fastifyHelmet.FastifyHelmetRouteOptions { }