z0mt3c / hapi-swaggered-ui

An easy swagger-ui drop-in plugin for hapi (to be used with hapi-swaggered).
39 stars 31 forks source link

Allow customization of hapi route options #137

Open abillingsley opened 5 years ago

abillingsley commented 5 years ago

For security reasons, I would like the swagger ui to include a content security policy. To do this we can use a hapi plugin called blankie.

The following is a plugin configuration and is applied globally to all routes

{
    plugin: require("blankie"),
    options: {
      fontSrc: ["self", "fonts.gstatic.com", "data:"],
      styleSrc: ["self", "fonts.googleapis.com", "unsafe-inline"],
      scriptSrc: ["self", "unsafe-inline"],
      imgSrc: ["self", "data:"],
      generateNonces: false,
    },
  }

Rather than applying this configuration globally I would like to configure the blankie plugin at the route level so the content security policy is defined as strictly as possible

This is achievable in the hapi ecosystem by the plugins route option

{
   ...
   plugins: {
      blankie: {
        fontSrc: ["self", "fonts.gstatic.com", "data:"],
        styleSrc: ["self", "fonts.googleapis.com", "unsafe-inline"],
        scriptSrc: ["self", "unsafe-inline"],
        imgSrc: ["self", "data:"],
        generateNonces: false,
      }
   },
}

it would be ideal if the hapi-swaggered-ui plugin options exposed a mechanism to control the route options

for example

{
    plugin: require("hapi-swaggered-ui"),
    options: {
      title: "My Documentation",
      path: "/documentation",
      swaggerOptions: {
        docExpansion: "list",
      },
      routeOptions: {
        ...anyOtherValidRouteOptions
        plugins: {
          blankie: {
            fontSrc: ["self", "fonts.gstatic.com", "data:"],
            styleSrc: ["self", "fonts.googleapis.com", "unsafe-inline"],
            scriptSrc: ["self", "unsafe-inline"],
            imgSrc: ["self", "data:"],
            generateNonces: false,
          }
        },
      },
    },
  }

This would not only enable my specific use case about control route specific plugins but would also allow any other customization of the route configuration that users of this plugin may desire.