Merge pull request #325 from ladesa-ro/dev/gabriel

fix: disable graphql playground and make helmet more strict
ladesa-ro · Oct 10, 2024 · 2057746 · 2057746
2 parents d803026 + 69461bc
commit 2057746
Show file tree

Hide file tree

Showing 2 changed files with 16 additions and 13 deletions.
diff --git a/api-service/src/infrastructure/integrations/graphql/integration-graphql.module.ts b/api-service/src/infrastructure/integrations/graphql/integration-graphql.module.ts
@@ -9,6 +9,19 @@ import { GraphQLModule } from "@nestjs/graphql";
     GraphQLModule.forRoot<ApolloDriverConfig>({
       driver: ApolloDriver,
 
+      /*
+        app.use(
+          helmet({
+            crossOriginEmbedderPolicy: false,
+            crossOriginResourcePolicy: {
+              policy: "cross-origin",
+            },
+            contentSecurityPolicy: isProduction ? undefined : false,
+          }),
+        );
+      */
+      playground: false,
+
       useGlobalPrefix: true,
       autoSchemaFile: true,
       introspection: true,

diff --git a/api-service/src/main.ts b/api-service/src/main.ts
@@ -1,10 +1,10 @@
+import { AppConfigService } from "@/infrastructure/config";
+import { SetupSwaggerDocument } from "@/infrastructure/integrations/http/swagger";
 import { NestFactory } from "@nestjs/core";
 import { SwaggerModule } from "@nestjs/swagger";
 import compression from "compression";
 import helmet from "helmet";
 import "reflect-metadata";
-import { AppConfigService } from "@/infrastructure/config";
-import { SetupSwaggerDocument } from "@/infrastructure/integrations/http/swagger";
 import { AppModule } from "./app.module";
 
 async function setupApp() {
@@ -22,17 +22,7 @@ async function setupApp() {
 
   //
 
-  const isProduction = configService.getRuntimeIsProduction();
-
-  app.use(
-    helmet({
-      crossOriginEmbedderPolicy: false,
-      crossOriginResourcePolicy: {
-        policy: "cross-origin",
-      },
-      contentSecurityPolicy: isProduction ? undefined : false,
-    }),
-  );
+  app.use(helmet());
 
   //