Node Cookbook - Third Edition

Hardening Hapi

We'll use a starter kit to quickly create a Hapi app:

$ git clone https://github.com/azaritech/hapi-starter-kit hapi-app$ cd hapi-app$ git reset --hard 5b6281$ npm install

Hapi doesn't have an equivalent of helmet so we'll have to add the headers ourselves. The way to achieve this globally (for example, across every request) is with the onPreResponse extension (Hapi terminology for a hook).

In the index.js file, just under the statement beginning init.connections we add:

server.ext('onPreResponse', (request, reply) => {  var response = request.response.isBoom ?     request.response.output :     request.response;  response.headers['X-DNS-Prefetch-Control'] = 'off';  response.headers['X-DNS-Prefetch-Control'] = 'off'; response.headers['X-Frame-Options'] ...