34 lines
968 B
Plaintext
34 lines
968 B
Plaintext
include::../description.adoc[]
|
|
|
|
include::../ask-yourself.adoc[]
|
|
|
|
include::../recommended.adoc[]
|
|
|
|
== Sensitive Code Example
|
|
|
|
In Express.js application the code is sensitive if the https://www.npmjs.com/package/dns-prefetch-control[dns-prefetch-control] middleware is not used or used without the recommended value:
|
|
|
|
----
|
|
const express = require('express');
|
|
const dnsPrefetchControl = require('dns-prefetch-control');
|
|
|
|
let app = express();
|
|
|
|
app.use(dnsPrefetchControl({ allow: true })); // Sensitive: allowing DNS prefetching is security-sensitive
|
|
----
|
|
|
|
== Compliant Solution
|
|
|
|
In Express.js application the https://www.npmjs.com/package/dns-prefetch-control[dns-prefetch-control] middleware is the standard way to implement X-DNS-Prefetch-Control header:
|
|
|
|
----
|
|
const express = require('express');
|
|
const dnsPrefetchControl = require('dns-prefetch-control');
|
|
|
|
let app = express();
|
|
|
|
app.use(dnsPrefetchControl({ allow: false })); // Compliant
|
|
----
|
|
|
|
include::../see.adoc[]
|