.github/workflows/ci.yml

@@ -17,6 +17,6 @@ on:
 
 jobs:
   test:
-    uses: fastify/workflows/.github/workflows/plugins-ci.yml@v5.0.0
+    uses: fastify/workflows/.github/workflows/plugins-ci.yml@v5
     with:
       license-check: true

README.md

@@ -2,7 +2,7 @@
 
 ![CI](https://github.com/fastify/fastify-helmet/workflows/CI/badge.svg)
 [![NPM version](https://img.shields.io/npm/v/@fastify/helmet)](https://www.npmjs.com/package/@fastify/helmet)
-[![js-standard-style](https://img.shields.io/badge/code%20style-standard-brightgreen.svg?style=flat)](http://standardjs.com/) 
+[![js-standard-style](https://img.shields.io/badge/code%20style-standard-brightgreen.svg?style=flat)](http://standardjs.com/)
 
 Important security headers for Fastify. It is a tiny wrapper around
 [helmet](https://npm.im/helmet).
@@ -88,15 +88,15 @@ fastify.get('/here-we-use-helmet-reply-decorator', async (request, reply) => {
     await reply.helmet({ frameguard: false })
   }
 
-  return { 
+  return {
     message: 'we use the helmet reply decorator to conditionally apply helmet middlewares'
   }
 })
 ```
 
 ### `helmet` route option
 
-`@fastify/helmet` allows you to enable, disable, and customize helmet for each one of your application hooks by using the 
+`@fastify/helmet` allows you to enable, disable, and customize helmet for each one of your application hooks by using the
 `helmet` shorthand route option when you register your application routes.
 
 If you want to disable helmet for a specific endpoint you must pass `{ helmet: false }` to your route options.
@@ -169,7 +169,7 @@ fastify.register(
 fastify.register(
   helmet,
   // customize content security policy with nonce generation
-  { 
+  {
     enableCSPNonces: true,
     contentSecurityPolicy: {
       directives: {
@@ -192,7 +192,7 @@ fastify.get('/', function(request, reply) {
 ```js
 fastify.register(
   helmet,
-  { 
+  {
     contentSecurityPolicy: {
       directives: {
         defaultSrc: ["'self'"],

index.js

@@ -97,7 +97,7 @@ async function replyDecorators (request, reply, configuration, enableCSP) {
 }
 
 async function buildHelmetOnRoutes (request, reply, configuration, enableCSP) {
-  if (enableCSP === true) {
+  if (enableCSP === true && configuration.contentSecurityPolicy !== false) {
     const cspDirectives = configuration.contentSecurityPolicy
       ? configuration.contentSecurityPolicy.directives
       : helmet.contentSecurityPolicy.getDefaultDirectives()

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fastify/helmet",
-  "version": "12.0.1",
+  "version": "13.0.0",
   "description": "Important security headers for Fastify",
   "main": "index.js",
   "type": "commonjs",
@@ -47,7 +47,7 @@
   },
   "dependencies": {
     "fastify-plugin": "^5.0.0",
-    "helmet": "^7.1.0"
+    "helmet": "^8.0.0"
   },
   "tsd": {
     "directory": "test/types"

test/routes.test.js

@@ -286,6 +286,44 @@ test('It should not set default directives when route useDefaults is set to `fal
   t.assert.deepStrictEqual(actualResponseHeaders, expected)
 })
 
+test('It should not set `content-security-policy` header, if route contentSecurityPolicy is false', async (t) => {
+  t.plan(1)
+
+  const fastify = Fastify()
+
+  await fastify.register(helmet, {
+    global: false,
+    enableCSPNonces: false,
+    contentSecurityPolicy: {
+      directives: {}
+    }
+  })
+
+  fastify.get(
+    '/',
+    {
+      helmet: {
+        contentSecurityPolicy: false
+      }
+    },
+    (request, reply) => {
+      reply.send({ hello: 'world' })
+    }
+  )
+
+  const response = await fastify.inject({ method: 'GET', path: '/' })
+
+  const expected = {
+    'content-security-policy': undefined
+  }
+
+  const actualResponseHeaders = {
+    'content-security-policy': response.headers['content-security-policy']
+  }
+
+  t.assert.deepStrictEqual(actualResponseHeaders, expected)
+})
+
 test('It should be able to conditionally apply the middlewares through the `helmet` reply decorator', async (t) => {
   t.plan(10)