rspec/rules/S5743/javascript/rule.adoc

include::../description.adoc[]

include::../ask-yourself.adoc[]

include::../recommended.adoc[]

== Sensitive Code Example

In Express.js application the code is sensitive if the https://www.npmjs.com/package/dns-prefetch-control[dns-prefetch-control] middleware is not used or used without the recommended value:

----
const express = require('express');
const dnsPrefetchControl = require('dns-prefetch-control');

let app = express();

app.use(dnsPrefetchControl({ allow: true })); // Sensitive: allowing DNS prefetching is security-sensitive
----

== Compliant Solution

In Express.js application the https://www.npmjs.com/package/dns-prefetch-control[dns-prefetch-control] middleware is the standard way to implement  X-DNS-Prefetch-Control header:

----
const express = require('express');
const dnsPrefetchControl = require('dns-prefetch-control');

let app = express();

app.use(dnsPrefetchControl({ allow: false })); // Compliant
----

include::../see.adoc[]