feat(security): enable Content-Security-Plolicy #263

handler/default.go

@@ -35,5 +35,5 @@ func GetHandler(d *sql.DB, serverSettings *types.ServerSettings) http.Handler {
 
 	authHandler.handle(router)
 
-	return middleware.Logging(middleware.EnableCors(serverSettings, router))
+	return middleware.Logging(middleware.ContentSecurityPolicy(middleware.EnableCors(serverSettings, router)))
 }

middleware/content_security_policiy.go

@@ -0,0 +1,11 @@
+package middleware
+
+import "net/http"
+
+func ContentSecurityPolicy(next http.Handler) http.Handler {
+
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Security-Policy", "default-src 'self'")
+		next.ServeHTTP(w, r)
+	})
+}