web-security
Decoupled web security implementations for Clojure.
Motivation
Provide web security implementations decoupled from any of http abstractions like ring, pedestal etc.
API
Content Security Policy (CSP)
Functions implementing CSP:
- csp/header-name returns normal or report-only name of the CSP header.
- csp/header-value-fn builds function for CSP header value from policy map, supports dynamic nonce substitution.
- csp/requires-nonce? tests if result of the
header-value-fnrequires nonce argument - csp/find-directive return policy directive value from the policy map
- csp/random-nonce-fn returns function to generate nonce values to be used in HTTP response.
HSTS
Functions for the Strict-Transport-Security response header:
Referrer-Policy
Functions for the Referrer-Policy response header:
Authored by Sergey Trofimov.
