41 lines
1.3 KiB
Go
41 lines
1.3 KiB
Go
package middleware
|
|
|
|
import (
|
|
"net/http"
|
|
|
|
"me-fit/types"
|
|
)
|
|
|
|
func SecurityHeaders(serverSettings *types.Settings) func(http.Handler) http.Handler {
|
|
|
|
return func(next http.Handler) http.Handler {
|
|
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
w.Header().Set("X-Content-Type-Options", "nosniff")
|
|
w.Header().Set("Access-Control-Allow-Origin", serverSettings.BaseUrl)
|
|
w.Header().Set("Access-Control-Allow-Methods", "GET, POST, DELETE")
|
|
w.Header().Set("Content-Security-Policy",
|
|
"default-src 'none';"+
|
|
"script-src 'self' https://umami.me-fit.eu"+
|
|
"connect-src 'self' https://umami.me-fit.eu"+
|
|
"img-src 'self'"+
|
|
"style-src 'self'"+
|
|
"form-action 'self'"+
|
|
"frame-ancestors 'none'",
|
|
)
|
|
w.Header().Set("Cross-Origin-Resource-Policy", "same-origin")
|
|
w.Header().Set("Cross-Origin-Opener-Policy", "same-origin")
|
|
w.Header().Set("Cross-Origin-Embedder-Policy", "require-corp")
|
|
w.Header().Set("Permissions-Policy", "geolocation=(), camera=(), microphone=(), interest-cohort=()")
|
|
w.Header().Set("Referrer-Policy", "strict-origin-when-cross-origin")
|
|
w.Header().Set("Strict-Transport-Security", "max-age=63072000; includeSubDomains; preload")
|
|
|
|
if r.Method == "OPTIONS" {
|
|
w.WriteHeader(http.StatusOK)
|
|
return
|
|
}
|
|
|
|
next.ServeHTTP(w, r)
|
|
})
|
|
}
|
|
}
|