deblan-mirror/thelounge
deblan-mirror/thelounge
1
0
Fork 0
mirror of https://github.com/thelounge/thelounge.git synced 2024-05-07 08:46:41 +02:00
Code Issues Projects Releases Wiki Activity

Force CSP header for all requests

Browse source 
Currently styles / plugins were not actually under the CSP
header protection.
There's no real reason to not have them for all requests, so
add them as a root middleware.
This commit is contained in:
Reto Brunner 2021-10-26 22:20:06 +02:00
parent 5d7e62ed67
commit 544146d9aa
1 changed files with 15 additions and 9 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

24
src/server.js
View file

@ -50,6 +50,7 @@ module.exports = function (options = {}) {
app.set("env", "production")
.disable("x-powered-by")
.use(allRequests)
.use(addSecurityHeaders)
.get("/", indexRequest)
.get("/service-worker.js", forceNoCacheRequest)
.get("/js/bundle.js.map", forceNoCacheRequest)
@ -286,14 +287,7 @@ function allRequests(req, res, next) {
return next();
}
function forceNoCacheRequest(req, res, next) {
// Intermittent proxies must not cache the following requests,
// browsers must fetch the latest version of these files (service worker, source maps)
res.setHeader("Cache-Control", "no-cache, no-transform");
return next();
}
function indexRequest(req, res) {
function addSecurityHeaders(req, res, next) {
const policies = [
"default-src 'none'", // default to nothing
"base-uri 'none'", // disallow <base>, has no fallback to default-src
@ -317,10 +311,22 @@ function indexRequest(req, res) {
policies.push("img-src http: https: data:");
}
res.setHeader("Content-Type", "text/html");
res.setHeader("Content-Security-Policy", policies.join("; "));
res.setHeader("Referrer-Policy", "no-referrer");
return next();
}
function forceNoCacheRequest(req, res, next) {
// Intermittent proxies must not cache the following requests,
// browsers must fetch the latest version of these files (service worker, source maps)
res.setHeader("Cache-Control", "no-cache, no-transform");
return next();
}
function indexRequest(req, res) {
res.setHeader("Content-Type", "text/html");
return fs.readFile(
path.join(__dirname, "..", "client", "index.html.tpl"),
"utf-8",