gravity-ui / expresskit Goto Github PK

RW originalContext is dangerous. Can we make it RO or (and) accessible by symbol?

• Check CODEOWNERS
• Add pre-commit commit message checks
• Protect main branch and setup PR settings
• Configure GitHub actions for package releases
• Add existing changes to CHANGELOG
• Release 1.0.0

We should determine if we want to implement CSRF support in the ExpressKit itself or recommend using some pre-made middleware like https://www.npmjs.com/package/csrf

Current DI:

constructor(nodekit: NodeKit, routes: AppRoutes) 

proposal:

constructor({nodekit}: {nodekit: : NodeKit}, routes: AppRoutes) 

This allow in future to inject new overrides for baseMiddleware

Currently, in our private core framework, we use internal CSP package which wraps express-csp-header adding some common-used internal csp rules.

We should implement CSP support in ExpressKit using express-csp-header, and:

1. Check if there is any additional differences between express-csp-header and our internal package that we should implement here (except for included default rules)
2. Understand how can we continue define/extend ExpressKit CSP rules using that internal package in our apps