harmacist/darkwire.io
1
0
Fork 0
mirror of https://github.com/darkwire/darkwire.io.git synced 2025-07-18 02:44:01 +00:00
Code Issues Projects Releases Wiki Activity

Security headers (#67)

Browse Source 
* Set test header

* Add security headers

* Update CSP to allow inline scripts and images

* Add empty string as API host value

* Add API host to CSP

* Use empty string if env var missing

* Add WSS and HTTPS protocols

* Undo app JSON change

* Set all headers in single object

* Fix typos
This commit is contained in:
Alan Friedman 2019-05-19 14:27:14 -04:00 committed by GitHub
parent b92a219247
commit a6c519e2f0
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 19 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
server/src/index.js
View File

@ -77,11 +77,29 @@ router.post('/abuse/:roomId', koaBody, async (ctx) => {
app.use(router.routes()); app.use(router.routes());
const cspDefaultSrc = `'self'${process.env.API_HOST ? ` https://${process.env.API_HOST} wss://${process.env.API_HOST}` : ''}`
function setStaticFileHeaders(ctx) {
ctx.set({
'strict-transport-security': 'max-age=31536000',
'Content-Security-Policy': `default-src ${cspDefaultSrc} 'unsafe-inline'; img-src 'self' data:;`,
'X-Frame-Options': 'deny',
'X-XSS-Protection': '1; mode=block',
'X-Content-Type-Options': 'nosniff',
'Referrer-Policy': 'no-referrer',
'Feature-Policy': "geolocation 'none'; vr 'none'; payment 'none'; microphone 'none'",
});
}
const clientDistDirectory = process.env.CLIENT_DIST_DIRECTORY; const clientDistDirectory = process.env.CLIENT_DIST_DIRECTORY;
if (clientDistDirectory) { if (clientDistDirectory) {
app.use(koaStatic(clientDistDirectory)); app.use(async (ctx, next) => {
setStaticFileHeaders(ctx);
await koaStatic(clientDistDirectory)(ctx, next);
});
app.use(async (ctx) => { app.use(async (ctx) => {
setStaticFileHeaders(ctx);
await koaSend(ctx, 'index.html', { root: clientDistDirectory }); await koaSend(ctx, 'index.html', { root: clientDistDirectory });
}) })
} else { } else {