moon
/
ditto
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Add a CSP

This commit is contained in:
Alex Gleason 2023-09-11 04:04:55 -05:00
parent 8a9f8454bf
commit 4310bb7157
No known key found for this signature in database
GPG Key ID: 7211D1F99744FBB7
2 changed files with 32 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/app.ts
View File

@ -60,6 +60,7 @@ import { nostrController } from './controllers/well-known/nostr.ts';
import { webfingerController } from './controllers/well-known/webfinger.ts';
import { auth19, requirePubkey } from './middleware/auth19.ts';
import { auth98, requireProof, requireRole } from './middleware/auth98.ts';
import { csp } from './middleware/csp.ts';
interface AppEnv extends HonoEnv {
Variables: {
@ -84,7 +85,7 @@ app.get('/api/v1/streaming', streamingController);
app.get('/api/v1/streaming/', streamingController);
app.get('/relay', relayController);
app.use('*', cors({ origin: '*', exposeHeaders: ['link'] }), auth19, auth98());
app.use('*', csp(), cors({ origin: '*', exposeHeaders: ['link'] }), auth19, auth98());
app.get('/.well-known/webfinger', webfingerController);
app.get('/.well-known/host-meta', hostMetaController);

30
src/middleware/csp.ts Normal file
View File

@ -0,0 +1,30 @@
import { AppMiddleware } from '@/app.ts';
import { Conf } from '@/config.ts';
const csp = (): AppMiddleware => {
return async (c, next) => {
const { host, protocol } = Conf.url;
const wsProtocol = protocol === 'http:' ? 'ws:' : 'wss:';
const policies = [
'upgrade-insecure-requests',
'script-src \'self\'',
`connect-src 'self' blob: ${Conf.localDomain} ${wsProtocol}//${host}`,
`media-src 'self' ${Conf.mediaDomain}`,
`img-src 'self' data: blob: ${Conf.mediaDomain}`,
'default-src \'none\'',
'base-uri \'self\'',
'frame-ancestors \'none\'',
'style-src \'self\' \'unsafe-inline\'',
'font-src \'self\'',
'manifest-src \'self\'',
'frame-src \'self\' https:',
];
c.res.headers.set('content-security-policy', policies.join('; '));
await next();
};
};
export { csp };