aboutsummaryrefslogtreecommitdiffhomepage
path: root/server/middlewares/csp.ts
diff options
context:
space:
mode:
Diffstat (limited to 'server/middlewares/csp.ts')
-rw-r--r--server/middlewares/csp.ts45
1 files changed, 45 insertions, 0 deletions
diff --git a/server/middlewares/csp.ts b/server/middlewares/csp.ts
new file mode 100644
index 000000000..a0ed3710b
--- /dev/null
+++ b/server/middlewares/csp.ts
@@ -0,0 +1,45 @@
1import * as helmet from 'helmet'
2import { CONFIG } from '../initializers/constants'
3
4const baseDirectives = Object.assign({},
5 {
6 defaultSrc: ["'none'"], // by default, not specifying default-src = '*'
7 connectSrc: ['*', 'data:'],
8 mediaSrc: ["'self'", 'https:', 'blob:'],
9 fontSrc: ["'self'", 'data:'],
10 imgSrc: ["'self'", 'data:'],
11 scriptSrc: ["'self' 'unsafe-inline'"],
12 styleSrc: ["'self' 'unsafe-inline'"],
13 // objectSrc: ["'none'"], // only define to allow plugins, else let defaultSrc 'none' block it
14 formAction: ["'self'"],
15 frameAncestors: ["'none'"],
16 baseUri: ["'self'"],
17 pluginTypes: ["'none'"],
18 manifestSrc: ["'self'"],
19 frameSrc: ["'self'"], // instead of deprecated child-src / self because of test-embed
20 workerSrc: ["'self'"], // instead of deprecated child-src
21 upgradeInsecureRequests: true
22 },
23 (CONFIG.SERVICES['CSP-LOGGER'] != null) ? { reportUri: CONFIG.SERVICES['CSP-LOGGER'] } : {}
24)
25
26const baseCSP = helmet.contentSecurityPolicy({
27 directives: baseDirectives,
28 browserSniff: false,
29 reportOnly: true
30})
31
32const embedCSP = helmet.contentSecurityPolicy({
33 directives: Object.assign(baseDirectives, {
34 frameAncestors: ['*']
35 }),
36 browserSniff: false, // assumes a modern browser, but allows CDN in front
37 reportOnly: true
38})
39
40// ---------------------------------------------------------------------------
41
42export {
43 baseCSP,
44 embedCSP
45}