@hint/hint-no-html-only-headers

v3.0.23

hint that that checks if HTML document only response headers are sent for other resources For more information about how to use this package see README

Latest version published 3 months ago

License: Apache-2.0

NPM

GitHub

Package Health Score

90 / 100

security
No known security issues
popularity
Recognized
maintenance
Healthy
community
Active

Explore Similar Packages

Security

No known security issues

All security vulnerabilities belong to production dependencies of direct and indirect packages.

Security and license risk for significant versions

All Versions

Version				Vulnerabilities	License Risk
3.0.23	\|	08/2024	Popular	0 C 0 H 0 M 0 L	0 H 0 M 0 L
2.4.3	\|	04/2020		0 C 0 H 0 M 0 L	0 H 0 M 0 L
1.0.4	\|	11/2018		0 C 0 H 0 M 0 L	0 H 0 M 0 L

License

Apache-2.0

Security Policy

Is your project affected by vulnerabilities?

Scan your projects for vulnerabilities. Fix quickly with automated fixes. Get started with Snyk for free.

Get started free

Popularity

Recognized

Weekly Downloads (9,162)

GitHub Stars: 3.62K
Forks: 683
Contributors: 110

Direct Usage Popularity

The npm package @hint/hint-no-html-only-headers receives a total of 9,162 downloads a week. As such, we scored @hint/hint-no-html-only-headers popularity level to be Recognized.

Based on project statistics from the GitHub repository for the npm package @hint/hint-no-html-only-headers, we found that it has been starred 3,623 times.

Downloads are calculated as moving averages for a period of the last 12 months, excluding weekends and known missing data points.

Community

Active

Readme.md: Yes
Contributing.md: Yes
Code of Conduct: Yes
Contributors: 110
Funding: No

A good and healthy external contribution signal for @hint/hint-no-html-only-headers project, which invites more than one hundred open source maintainers to collaborate on the repository.

Embed Package Health Score Badge

Maintenance

Healthy

Commit Frequency

Open Issues: 320
Open PR: 138
Last Release: 3 months ago
Last Commit: 2 months ago

Further analysis of the maintenance status of @hint/hint-no-html-only-headers based on released npm versions cadence, the repository activity, and other data points determined that its maintenance is Healthy.

We found that @hint/hint-no-html-only-headers demonstrates a positive version release cadence with at least one new version released in the past 3 months.

As a healthy sign for on-going project maintenance, we found that the GitHub repository had at least 1 pull request or issue interacted with by the community.

Keep your project healthy

Check your package.json

Ensure all the packages you're using are healthy and well-maintained

Snyk Vulnerability Scanner

Get health score & security insights directly in your IDE

Package

Node.js Compatibility: not defined

Age: 6 years
Dependencies: 5 Direct
Versions: 53
Install Size: 30 kB
Dist-tags: 1
# of Files: 13
Maintainers: 5
TS Typings: No

@hint/hint-no-html-only-headers has more than a single and default latest tag published for the npm package. This means, there may be other tags available for this package, such as next to indicate future releases, or stable to indicate stable releases.

Readme

Unneeded HTTP headers (`no-html-only-headers`)

no-html-only-headers warns against responding with HTTP headers that are not needed for non-HTML (or non-XML) resources.

Why is this important?

Some HTTP headers do not make sense to be sent for non-HTML resources, as sending them does not provide any value to users and contributes to header bloat.

What does the hint check?

The hint checks if non-HTML responses include any of the following HTTP headers:

Content-Security-Policy
X-Content-Security-Policy
X-UA-Compatible
X-WebKit-CSP
X-XSS-Protection

In case of a JavaScript file, Content-Security-Policy and X-Content-Security-Policy will be ignored since CSP is also relevant to workers.

Examples that trigger the hint

Response for /test.js:

HTTP/... 200 OK

Content-Type: text/javascript; charset=utf-8
...
X-UA-Compatible: IE=Edge,
X-WebKit-CSP: default-src 'none'
X-XSS-Protection: 1; mode=block
...

Response for /test.html:

HTTP/... 200 OK

Content-Type: x/y
...
Content-Security-Policy: default-src 'none'
X-Content-Security-Policy: default-src 'none'
X-UA-Compatible: IE=Edge,
X-WebKit-CSP: default-src 'none'
X-XSS-Protection: 1; mode=block
...

Examples that pass the hint

Response for /test.js:

HTTP/... 200 OK

Content-Type: text/javascript; charset=utf-8
Content-Security-Policy: default-src 'none'
X-Content-Security-Policy: default-src 'none'
...

Response for /test.html:

HTTP/... 200 OK

Content-Type: text/html
...
Content-Security-Policy: default-src 'none'
X-Content-Security-Policy: default-src 'none'
X-UA-Compatible: IE=Edge,
X-WebKit-CSP: default-src 'none'
X-XSS-Protection: 1; mode=block
...

Response for /test.xml:

HTTP/... 200 OK

Content-Type: application/xhtml+xml
...
Content-Security-Policy: default-src 'none'
X-Content-Security-Policy: default-src 'none'
X-UA-Compatible: IE=Edge,
X-WebKit-CSP: default-src 'none'
X-XSS-Protection: 1; mode=block
...

How to configure the server to pass this hint

How to configure Apache

Apache can be configured to remove headers using the Header directive.

To remove the headers that are not needed for non-HTML resources, you can do something such as the following:



    # Because `mod_headers` cannot match based on the content-type,
    # the following workaround needs to be used.

    
        Header unset X-UA-Compatible
        Header unset X-XSS-Protection
    

    
        Header unset Content-Security-Policy
        Header unset X-Content-Security-Policy
        Header unset X-WebKit-CSP

Note that:

The above snippet works with Apache v2.2.0+, but you need to have mod_headers enabled for it to take effect.
If you have access to the main Apache configuration file (usually called httpd.conf), you should add the logic in, for example, a `` section in that file. This is usually the recommended way as using .htaccess files slows down Apache!

If you don't have access to the main configuration file (quite common with hosting services), add the snippets in a .htaccess file in the root of the web site/app.

For the complete set of configurations, not just for this rule, see the Apache server configuration related documentation.

How to configure IIS

If your application is adding the headers unconditionally to all responses and you cannot modify it, the solution is to create URL rewrite rules that will remove them from any resource whose Content-Type header isn't text/html:

Note that:

If your site uses a mime type different than text/html to serve HTML content (e.g.: application/xhtml+xml), you'll have to update the value of pattern.
The above snippet works with IIS 7+.
You should use the above snippet in the web.config of your application.

For the complete set of configurations, not just for this rule, see the IIS server configuration related documentation.

Can the hint be configured?

Yes, you can use:

include to specify additional HTTP headers that should be disallowed for non-HTML resources
ignore to specify which of the disallowed HTTP headers should be ignored

E.g. The following hint configuration used in the .hintrc file will make the hint allow non-HTML resources to be served with the Content-Security-Policy HTTP header, but not with Custom-Header.

{
    "connector": {...},
    "formatters": [...],
    "hints": {
        "no-html-only-headers": [ "warning", {
            "ignore": ["Content-Security-Policy"],
            "include": ["Custom-Header"]
        }],
        ...
    },
    ...
}

How to use this hint?

This package is installed automatically by webhint:

npm install hint --save-dev

To use it, activate it via the .hintrc configuration file:

{
    "connector": {...},
    "formatters": [...],
    "hints": {
        "no-html-only-headers": "error",
        ...
    },
    "parsers": [...],
    ...
}

Note: The recommended way of running webhint is as a devDependency of your project.

@hint/hint-no-html-only-headers dependencies

@hint/utils-debug @hint/utils-i18n @hint/utils-network @hint/utils-string @hint/utils-types

@hint/hint-no-html-only-headers development dependencies

@hint/utils-create-server @hint/utils-tests-helpers @types/node @typescript-eslint/eslint-plugin @typescript-eslint/parser ava copyfiles eslint eslint-plugin-import eslint-plugin-markdown npm-run-all nyc rimraf typescript

FAQs

What is @hint/hint-no-html-only-headers?

hint that that checks if HTML document only response headers are sent for other resources. Visit Snyk Advisor to see a full health score report for @hint/hint-no-html-only-headers, including popularity, security, maintenance & community analysis.

Is @hint/hint-no-html-only-headers popular?

The npm package @hint/hint-no-html-only-headers receives a total of 9,162 weekly downloads. As such, @hint/hint-no-html-only-headers popularity was classified as a recognized. Visit the popularity section on Snyk Advisor to see the full health analysis.

Is @hint/hint-no-html-only-headers well maintained?

We found that @hint/hint-no-html-only-headers demonstrated a healthy version release cadence and project activity. It has a community of 110 open source contributors collaborating on the project. See the full package health analysis to learn more about the package maintenance status.

Is @hint/hint-no-html-only-headers safe to use?

The npm package @hint/hint-no-html-only-headers was scanned for known vulnerabilities and missing license, and no issues were found. Thus the package was deemed as safe to use. See the full health analysis review.

Last updated on 10 November-2024, at 05:07 (UTC).

Build a secure application checklist

Select a recommended open source package

Minimize your risk by selecting secure & well maintained open source packages

DONE

Scan your app for vulnerabilities

Scan your application to find vulnerabilities in your: source code, open source dependencies, containers and configuration files

SCAN NOW

Fix identified vulnerabilities

Easily fix your code by leveraging automatically generated PRs

AUTO FIX

Monitor for new issues

New vulnerabilities are discovered every day. Get notified if your application is affected

MONITOR APP