Tim Wundenberg
0246ada70e
Some checks failed
Build Docker Image / Build-Docker-Image (push) Failing after 39s
41 lines
1.4 KiB
Go
41 lines
1.4 KiB
Go
package middleware
|
|
|
|
import (
|
|
"net/http"
|
|
|
|
"me-fit/types"
|
|
)
|
|
|
|
func SecurityHeaders(serverSettings *types.Settings) func(http.Handler) http.Handler {
|
|
|
|
return func(next http.Handler) http.Handler {
|
|
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
w.Header().Set("X-Content-Type-Options", "nosniff")
|
|
w.Header().Set("Access-Control-Allow-Origin", serverSettings.BaseUrl)
|
|
w.Header().Set("Access-Control-Allow-Methods", "GET, POST, DELETE")
|
|
w.Header().Set("Content-Security-Policy",
|
|
"default-src 'none'; "+
|
|
"script-src 'self' https://umami.me-fit.eu; "+
|
|
"connect-src 'self' https://umami.me-fit.eu; "+
|
|
"img-src 'self'; "+
|
|
"style-src 'self'; "+
|
|
"form-action 'self'; "+
|
|
"frame-ancestors 'none'; ",
|
|
)
|
|
w.Header().Set("Cross-Origin-Resource-Policy", "same-site") // same-site, as same origin prohibits umami
|
|
w.Header().Set("Cross-Origin-Opener-Policy", "same-origin")
|
|
w.Header().Set("Cross-Origin-Embedder-Policy", "require-corp")
|
|
w.Header().Set("Permissions-Policy", "geolocation=(), camera=(), microphone=(), interest-cohort=()")
|
|
w.Header().Set("Referrer-Policy", "strict-origin-when-cross-origin")
|
|
w.Header().Set("Strict-Transport-Security", "max-age=63072000; includeSubDomains; preload")
|
|
|
|
if r.Method == "OPTIONS" {
|
|
w.WriteHeader(http.StatusOK)
|
|
return
|
|
}
|
|
|
|
next.ServeHTTP(w, r)
|
|
})
|
|
}
|
|
}
|