supernets/hardlounge
supernets/hardlounge
4
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge pull request #4344 from brunnre8/csp

Browse Source 
Force CSP headers for all requests
This commit is contained in:
Max Leiter 2021-11-02 12:51:39 -07:00 committed by GitHub
commit fd730eeeb1
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 15 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
src/server.js
View File

@ -50,6 +50,7 @@ module.exports = function (options = {}) {
app.set("env", "production")
.disable("x-powered-by")
.use(allRequests)
.use(addSecurityHeaders)
.get("/", indexRequest)
.get("/service-worker.js", forceNoCacheRequest)
.get("/js/bundle.js.map", forceNoCacheRequest)
@ -286,14 +287,7 @@ function allRequests(req, res, next) {
return next();
}
function forceNoCacheRequest(req, res, next) {
// Intermittent proxies must not cache the following requests,
// browsers must fetch the latest version of these files (service worker, source maps)
res.setHeader("Cache-Control", "no-cache, no-transform");
return next();
}
function indexRequest(req, res) {
function addSecurityHeaders(req, res, next) {
const policies = [
"default-src 'none'", // default to nothing
"base-uri 'none'", // disallow <base>, has no fallback to default-src
@ -317,10 +311,22 @@ function indexRequest(req, res) {
policies.push("img-src http: https: data:");
}
res.setHeader("Content-Type", "text/html");
res.setHeader("Content-Security-Policy", policies.join("; "));
res.setHeader("Referrer-Policy", "no-referrer");
return next();
}
function forceNoCacheRequest(req, res, next) {
// Intermittent proxies must not cache the following requests,
// browsers must fetch the latest version of these files (service worker, source maps)
res.setHeader("Cache-Control", "no-cache, no-transform");
return next();
}
function indexRequest(req, res) {
res.setHeader("Content-Type", "text/html");
return fs.readFile(
path.join(__dirname, "..", "client", "index.html.tpl"),
"utf-8",