altair-graphql · imolorhe · Sep 24, 2025 · Feb 27, 2025 · Sep 21, 2025 · Sep 21, 2025
diff --git a/bin/dev.sh b/bin/dev.sh
@@ -6,7 +6,7 @@ SCRIPT_DIR=$(dirname "$0")
 ROOT=$(cd "$SCRIPT_DIR/../" && pwd)/
 cd "$ROOT"
 
-(cd packages/altair-api; docker compose up  --no-recreate -d)
+(cd packages/altair-api; docker compose up --remove-orphans  --no-recreate -d)
 
 pnpm install
 
@@ -16,4 +16,4 @@ trap_exit() {
 trap trap_exit EXIT
 
 # stripe login (if API key is expired)
-npx concurrently --kill-others "pnpm start:app" "pnpm start:api:dev" "pnpm start:redirect" "pnpm start:sandbox" "pnpm start:docs" "pnpm start:stripe:listen" --names app,api,redirect,sandbox,docs,stripe
+pnpm concurrently --kill-others "pnpm start:app" "pnpm start:api:dev" "pnpm start:redirect" "pnpm start:sandbox" "pnpm start:docs" "pnpm start:stripe:listen" --names app,api,redirect,sandbox,docs,stripe
diff --git a/examples/express-v4/index.ts b/examples/express-v4/index.ts
@@ -1,9 +1,33 @@
 import express from 'express';
 import { altairExpress } from '../../packages/altair-express-middleware/build';
+import helmet from 'helmet';
+import crypto from 'crypto';
 const app = express();
 app.disable('x-powered-by');
-const port = 3000;
+const port = 3002;
 
+app.use((req, res, next) => {
+  res.locals.cspNonce = crypto.randomBytes(16).toString('base64');
+  next();
+});
+app.use(
+  helmet({
+    contentSecurityPolicy: {
+      directives: {
+        // ...helmet.contentSecurityPolicy.getDefaultDirectives(),
+        scriptSrc: [
+          "'self'",
+          "'sha256-kFTKSG2YSVB69S6DWzferO6LmwbqfHmYBTqvVbPEp4I='",
+          (req, res) => `'nonce-${(res as any).locals.cspNonce}'`,
+        ],
+        styleSrc: [
+          "'self'",
+          (req, res) => `'nonce-${(res as any).locals.cspNonce}'`,
+        ],
+      },
+    },
+  })
+);
 // Mount your Altair GraphQL client
 app.use(
   '/altair',
@@ -19,6 +43,8 @@ app.use(
       },
     },
     initialSubscriptionRequestHandlerId: 'graphql-sse',
+    serveInitialOptionsInSeperateRequest: true,
+    cspNonceGenerator: (req, res) => res.locals.cspNonce,
   })
 );
 
@@ -27,5 +53,6 @@ app.get('/', (req, res) => {
 });
 
 app.listen(port, () => {
+  // eslint-disable-next-line no-console
   console.log(`listening on port ${port}`);
 });
diff --git a/examples/express-v4/package.json b/examples/express-v4/package.json
@@ -6,15 +6,17 @@
     "@types/express": "^5.0.0",
     "@types/node": "^22.7.4",
     "ts-node": "^10.9.2",
+    "ts-node-dev": "^2.0.0",
     "typescript": "5.2.2"
   },
   "license": "MIT",
   "private": true,
   "dependencies": {
-    "express": "^4.21.1"
+    "express": "^4.21.1",
+    "helmet": "^8.1.0"
   },
   "scripts": {
-    "start": "ts-node index.ts"
+    "start": "ts-node-dev index.ts"
   },
   "packageManager": "[email protected]"
 }