Merge pull request #65 from dadosfera/addHelmet

added helmet package to protect headers security

package-lock.json

@@ -22,6 +22,7 @@
         "axios": "^0.25.0",
         "dotenv": "^14.2.0",
         "grpc": "^1.24.11",
+        "helmet": "^5.0.2",
         "jsonwebtoken": "^8.5.1",
         "jwk-to-pem": "^2.0.5",
         "reflect-metadata": "^0.1.13",
@@ -5232,6 +5233,14 @@
         "minimalistic-assert": "^1.0.1"
       }
     },
+    "node_modules/helmet": {
+      "version": "5.0.2",
+      "resolved": "https://registry.npmjs.org/helmet/-/helmet-5.0.2.tgz",
+      "integrity": "sha512-QWlwUZZ8BtlvwYVTSDTBChGf8EOcQ2LkGMnQJxSzD1mUu8CCjXJZq/BXP8eWw4kikRnzlhtYo3lCk0ucmYA3Vg==",
+      "engines": {
+        "node": ">=12.0.0"
+      }
+    },
     "node_modules/hexoid": {
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/hexoid/-/hexoid-1.0.0.tgz",
@@ -13620,6 +13629,11 @@
         "minimalistic-assert": "^1.0.1"
       }
     },
+    "helmet": {
+      "version": "5.0.2",
+      "resolved": "https://registry.npmjs.org/helmet/-/helmet-5.0.2.tgz",
+      "integrity": "sha512-QWlwUZZ8BtlvwYVTSDTBChGf8EOcQ2LkGMnQJxSzD1mUu8CCjXJZq/BXP8eWw4kikRnzlhtYo3lCk0ucmYA3Vg=="
+    },
     "hexoid": {
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/hexoid/-/hexoid-1.0.0.tgz",

package.json

@@ -34,6 +34,7 @@
     "axios": "^0.25.0",
     "dotenv": "^14.2.0",
     "grpc": "^1.24.11",
+    "helmet": "^5.0.2",
     "jsonwebtoken": "^8.5.1",
     "jwk-to-pem": "^2.0.5",
     "reflect-metadata": "^0.1.13",

src/main.ts

@@ -1,6 +1,7 @@
 import { NestFactory } from '@nestjs/core';
 import { DocumentBuilder, SwaggerModule } from '@nestjs/swagger';
 import { writeFileSync } from 'fs';
+import helmet from 'helmet';
 
 import { AppModule } from './app.module';
 
@@ -14,6 +15,8 @@ async function bootstrap() {
     },
   });
 
+  app.use(helmet());
+
   const config = new DocumentBuilder()
     .setTitle('Maestro Grpc Documentation')
     .setDescription('Documentation for Maestro gateway')

src/modules/catalog/catalog.service.ts

@@ -245,7 +245,6 @@ class CatalogService {
     return data;
   }
 
-  
   async deleteTags(id, body) {
     const customer =
       body.info.customer.toLowerCase() === 'dadosfera'