Application security for express.

var express = require('express'),
	appsec = require('lusca'),
	server = express();

server.use(appsec.csrf());
server.use(appsec.csp({ /* ... */}));
server.use(appsec.xframe('SAMEORIGIN'));
server.use(appsec.p3p('ABCDEF'));

Or you can opt in to all purely by config:

server.use(appsec({
    csrf: true,
    csp: { /* ... */},
    xframe: 'SAMEORIGIN',
    p3p: 'ABCDEF' 
}));

Enables Cross Site Request Forgery (CSRF) headers.

If enabled, the CSRF token must be in the payload when modifying data or you will receive a 403 Forbidden. To send the token you'll need to echo back the _csrf value you received from the previous request.

• options.policy Object - Object definition of policy.
• options.reportOnly boolean - Enable report only mode.
• options.reportUri String - URI where to send the report data

Enables Content Security Policy (CSP) headers.

• value String - The value for the header, e.g. one of DENY, SAMEORIGIN or ALLOW-FROM uri.

Enables X-FRAME-OPTIONS headers to help prevent Clickjacking.

• value String - The compact privacy policy.

Enables Platform for Privacy Preferences Project (P3P) headers.