Helment

package.json

@@ -51,6 +51,7 @@
     "class-transformer": "^0.5.1",
     "class-validator": "^0.14.0",
     "handlebars": "^4.7.9",
+    "helmet": "^8.2.0",
     "ioredis": "^5.10.1",
     "jsonwebtoken": "^9.0.3",
     "nodemailer": "^8.0.4",

src/dtos/create-cat.dto.ts

@@ -11,4 +11,4 @@ export class CreateCatDto {
 
   @IsNotEmpty()
   readonly age: number;
-}
+}

src/main.ts

@@ -1,10 +1,24 @@
-import { NestFactory, ValidationPipe } from '@nestjs/core';
+import { NestFactory } from '@nestjs/core';
+import { ValidationPipe } from '@nestjs/common';
 import { AppModule } from './app.module';
 import { SwaggerModule, DocumentBuilder } from '@nestjs/swagger';
+import helmet from 'helmet';
 
 async function bootstrap() {
   const app = await NestFactory.create(AppModule);
   app.setGlobalPrefix('api/v1');
+  app.use(
+    helmet({
+      contentSecurityPolicy: {
+        directives: {
+          defaultSrc: ["'self'"],
+          styleSrc: ["'self'", "'unsafe-inline'"],
+          scriptSrc: ["'self'"],
+          imgSrc: ["'self'", 'data:', 'https:'],
+        },
+      },
+    }),
+  );
   app.useGlobalPipes(
     new ValidationPipe({
       whitelist: true,
@@ -14,7 +28,6 @@ async function bootstrap() {
   );
   app.enableShutdownHooks();
 
-  // Configure Swagger/OpenAPI
   const swaggerConfig = new DocumentBuilder()
     .setTitle('NexaFx API')
     .setDescription('NexaFx financial platform REST API')
@@ -30,4 +43,4 @@ async function bootstrap() {
   await app.listen(process.env.PORT ?? 3000);
 }
 
-bootstrap();
+void bootstrap();

test/app.e2e-spec.ts

@@ -17,6 +17,8 @@ describe('AppController (e2e)', () => {
     process.env.JWT_SECRET = 'test-jwt-secret';
     process.env.REFRESH_TOKEN_SECRET = 'test-refresh-token-secret';
     process.env.OTP_SECRET = 'test-otp-secret';
+    process.env.WALLET_ENCRYPTION_KEY =
+      '0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef';
     process.env.WALLET_ENCRYPTION_KEY = '0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef';
     process.env.BLOCKCHAIN_RPC_URL = 'http://localhost:8545';
     process.env.PROVIDER_API_URL = 'https://api.example.com';
@@ -66,4 +68,4 @@ describe('AppController (e2e)', () => {
       .send({ name: 'Fluffy', breed: 'Persian', age: 3 })
       .expect(201);
   });
-});
+});