fedi/lemmy-ui
1
0
Fork 0
mirror of https://github.com/LemmyNet/lemmy-ui.git synced 2024-11-30 09:02:30 +00:00
Code Issues Packages Projects Releases Wiki Activity

Set content security policy http header for all responses

Browse source
This commit is contained in:
Felix Ableitner 2022-04-05 14:43:56 +02:00 committed by Nutomic
parent 2274f51e8d
commit eb1606c9c2
1 changed files with 7 additions and 14 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

21
src/server/index.tsx
View file

@ -27,6 +27,13 @@ const [hostname, port] = process.env["LEMMY_UI_HOST"]
const extraThemesFolder =
process.env["LEMMY_UI_EXTRA_THEMES_FOLDER"] || "./extra_themes";
server.use(function (_req, res, next) {
res.setHeader(
"Content-Security-Policy",
"default-src 'none'; connect-src 'self'; img-src * data:; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; form-action 'self'; base-uri 'self'"
);
next();
});
server.use(express.json());
server.use(express.urlencoded({ extended: false }));
server.use("/static", express.static(path.resolve("./dist")));
@ -166,13 +173,6 @@ server.get("/*", async (req, res) => {
return res.redirect(context.url);
}
const cspHtml = (
<meta
http-equiv="Content-Security-Policy"
content="default-src data: 'self'; connect-src * ws: wss:; frame-src *; img-src * data:; script-src 'self'; style-src 'self' 'unsafe-inline'; manifest-src 'self'"
/>
);
const eruda = (
<>
<script src="//cdn.jsdelivr.net/npm/eruda"></script>
@ -180,12 +180,8 @@ server.get("/*", async (req, res) => {
</>
);
const erudaStr = process.env["LEMMY_UI_DEBUG"] ? renderToString(eruda) : "";
const root = renderToString(wrapper);
const symbols = renderToString(SYMBOLS);
const cspStr = process.env.LEMMY_EXTERNAL_HOST
? renderToString(cspHtml)
: "";
const helmet = Helmet.renderStatic();
const config: ILemmyConfig = { wsHost: process.env.LEMMY_WS_HOST };
@ -208,9 +204,6 @@ server.get("/*", async (req, res) => {
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">
<!-- Content Security Policy -->
${cspStr}
<!-- Web app manifest -->
<link rel="manifest" href="/static/assets/manifest.webmanifest">