Merge pull request #4 from shaunwarman/use-expect-ct-config

feat: add Expect-CT header

Author: shaunwarman

.gitignore

@@ -5,3 +5,4 @@ node_modules
 coverage
 .nyc_output
 locales
+package-lock.json

index.js

@@ -17,6 +17,7 @@ const conditional = require('koa-conditional-get');
 const cors = require('kcors');
 const errorHandler = require('koa-better-error-handler');
 const etag = require('koa-etag');
+const expectCt = require('koa-expect-ct');
 const helmet = require('koa-helmet');
 const json = require('koa-json');
 const koa404Handler = require('koa-404-handler');
@@ -125,7 +126,10 @@ class API {
     if (this.config.cors) app.use(cors(this.config.cors));
 
     // security
-    app.use(helmet());
+    if (this.config.helmet) app.use(helmet(this.config.helmet));
+
+    // add Expect-CT header for cert transparency
+    if (this.config.expectCT) app.use(expectCt(this.config.expectCT));
 
     // remove trailing slashes
     app.use(removeTrailingSlashes());

package.json

@@ -39,6 +39,7 @@
     "koa-conditional-get": "^2.0.0",
     "koa-connect": "^2.0.1",
     "koa-etag": "^3.0.0",
+    "koa-expect-ct": "^0.0.1",
     "koa-helmet": "^5.2.0",
     "koa-json": "^2.0.2",
     "koa-no-trailing-slash": "^2.1.0",