fedi/lemmy-ui
1
0
Fork 0
mirror of https://github.com/LemmyNet/lemmy-ui.git synced 2024-11-09 10:02:12 +00:00
Code Issues Packages Projects Releases Wiki Activity

Set content security policy http header for all responses

Browse source
This commit is contained in:
Felix Ableitner 2022-04-05 14:43:56 +02:00 committed by Dessalines
parent 057a9ff4f5
commit 62c237949c
1 changed files with 7 additions and 13 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

20
src/server/index.tsx
View file

@ -27,6 +27,13 @@ const [hostname, port] = process.env["LEMMY_UI_HOST"]
const extraThemesFolder =
process.env["LEMMY_UI_EXTRA_THEMES_FOLDER"] || "./extra_themes";
server.use(function (_req, res, next) {
res.setHeader(
"Content-Security-Policy",
"default-src data: 'self'; connect-src * ws: wss:; frame-src *; img-src * data:; script-src 'self'; style-src 'self' 'unsafe-inline'; manifest-src 'self'"
);
next();
});
server.use(express.json());
server.use(express.urlencoded({ extended: false }));
server.use("/static", express.static(path.resolve("./dist")));
@ -164,18 +171,8 @@ server.get("/*", async (req, res) => {
return res.redirect(context.url);
}
const cspHtml = (
<meta
http-equiv="Content-Security-Policy"
content="default-src data: 'self'; connect-src * ws: wss:; frame-src *; img-src * data:; script-src 'self'; style-src 'self' 'unsafe-inline'; manifest-src 'self'"
/>
);
const root = renderToString(wrapper);
const symbols = renderToString(SYMBOLS);
const cspStr = process.env.LEMMY_EXTERNAL_HOST
? renderToString(cspHtml)
: "";
const helmet = Helmet.renderStatic();
const config: ILemmyConfig = { wsHost: process.env.LEMMY_WS_HOST };
@ -200,9 +197,6 @@ server.get("/*", async (req, res) => {
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">
<!-- Content Security Policy -->
${cspStr}
<!-- Web app manifest -->
<link rel="manifest" href="/static/assets/manifest.webmanifest">