Add Configurable browser policy

demo/server/helmetConfig.js

@@ -0,0 +1,17 @@
+import helmet from 'helmet';
+
+
+// See for https://github.com/helmetjs/helmet for details of configuration
+const helmetConfig = helmet({
+  contentSecurityPolicy: {
+    directives: {
+      defaultSrc: ["'none'"],
+      imgSrc: ["'self'"],
+      scriptSrc: ["'self'", "'unsafe-inline'", "'unsafe-eval'"],
+      styleSrc: ["'self'", "'unsafe-inline'" ],
+      connectSrc : ["'self'", 'ws:'],
+    }
+  }
+});
+
+export default helmetConfig;

demo/server/main.js

@@ -12,6 +12,8 @@ import PubSub from '/imports/api/PubSub';
 import '/imports/api/PubSub/server';
 // Store subscription
 import storeSubscription from '/imports/store';
+//helmet config
+import helmetConfig from './helmetConfig';
 // i18n
 // eslint-disable-next-line no-unused-vars
 import i18n from '/imports/i18n/i18nServer';
@@ -37,6 +39,8 @@ logger.info('Starting router');
 createRouter({
   // Your MainApp as the top component rendered and injected in the HTML payload
   MainApp,
+  // Optional: Helmet config
+  helmetConfig,
   // Optional: Store subscription
   storeSubscription,
   // Optional: An object containing your application reducers

src/server/createRouter.js

@@ -36,6 +36,7 @@ const EXPRESS_COVERED_URL = /^\/(?!api\/)(?!__cordova\/)[^.]*$/;
 /* eslint-disable no-param-reassign */
 const createRouter = ({
   MainApp,
+  helmetConfig,
   storeSubscription,
   appReducers = {},
   appCursors = {},
@@ -56,6 +57,8 @@ const createRouter = ({
   const app = express();
   // Secure Express
   app.use(helmet());
+  // modify express if supplied
+  if (helmetConfig) app.use(helmetConfig);
   // express middleware to handle i18n
   if (i18n) app.use(i18nMiddleware.handle(i18n));
   app