Web-standards-compliance (#1001)

* minor tweaks to make browser things happier

kanidmd/score/src/https/manifest.rs

@@ -4,7 +4,7 @@ use crate::https::{AppState, RequestExtensions};
 use serde::{Deserialize, Serialize};
 
 /// The MIME type for `.webmanifest` files.
-const MIME_TYPE_MANIFEST: &str = "application/manifest+json";
+const MIME_TYPE_MANIFEST: &str = "application/manifest+json;charset=utf-8";
 
 /// Create a new manifest builder.
 #[derive(Debug, Clone, Serialize, Deserialize)]
@@ -155,39 +155,3 @@ pub async fn manifest(req: tide::Request<AppState>) -> tide::Result {
 
     Ok(res)
 }
-
-//     "start_url": "/?source=pwa",
-//     "background_color": "#3367D6",
-//     "display": "standalone",
-//     "scope": "/",
-//     "theme_color": "#3367D6",
-//     "shortcuts": [
-//       {
-//         "name": "How's weather today?",
-//         "short_name": "Today",
-//         "description": "View weather information for today",
-//         "url": "/today?source=pwa",
-//         "icons": [{ "src": "/images/today.png", "sizes": "192x192" }]
-//       },
-//       {
-//         "name": "How's weather tomorrow?",
-//         "short_name": "Tomorrow",
-//         "description": "View weather information for tomorrow",
-//         "url": "/tomorrow?source=pwa",
-//         "icons": [{ "src": "/images/tomorrow.png", "sizes": "192x192" }]
-//       }
-//     ],
-//     "description": "Weather forecast information",
-//     "screenshots": [
-//       {
-//         "src": "/images/screenshot1.png",
-//         "type": "image/png",
-//         "sizes": "540x720"
-//       },
-//       {
-//         "src": "/images/screenshot2.jpg",
-//         "type": "image/jpg",
-//         "sizes": "540x720"
-//       }
-//     ]
-//   }

kanidmd/score/src/https/middleware.rs

@@ -8,27 +8,31 @@ use regex::Regex;
 /// use score::https::middleware::compression_content_type_checker;
 /// let these_should_match = vec![
 ///     "application/wasm",
+///     "application/x-javascript",
+///     "application/x-javascript; charset=utf-8",
+///     "image/svg+xml",
 ///     "text/json",
-///     "text/javascript"
+///     "text/javascript",
 /// ];
 /// for test_value in these_should_match {
 ///     eprintln!("checking {:?}", test_value);
 ///     assert!(compression_content_type_checker().is_match(test_value));
 /// }
 /// assert!(compression_content_type_checker().is_match("application/wasm"));
-/// let these_should_fail = vec![
+/// let these_should_be_skipped = vec![
+///     "application/manifest+json",
 ///     "image/jpeg",
 ///     "image/wasm",
 ///     "text/html",
 /// ];
-/// for test_value in these_should_fail {
+/// for test_value in these_should_be_skipped {
 ///     eprintln!("checking {:?}", test_value);
 ///     assert!(!compression_content_type_checker().is_match(test_value));
 /// }
 /// ```
 pub fn compression_content_type_checker() -> Regex {
-    Regex::new(r"^(?:(image/svg\+xml)|(?:application|text)/(?:css|javascript|json|text|xml|wasm))$")
-        .expect("regex matcher for tide_compress content-type check failed to compile")
+    Regex::new(r"^(?:(image/svg\+xml)|(?:application|text)/(?:css|javascript|json|text|x-javascript|xml|wasm))(|; charset=utf-8)$")
+    .expect("regex matcher for tide_compress content-type check failed to compile")
 }
 
 #[derive(Default)]
@@ -102,7 +106,6 @@ impl<State: Clone + Send + Sync + 'static> tide::Middleware<State> for StrictRes
         response.insert_header("cross-origin-opener-policy", "same-origin");
         response.insert_header("cross-origin-resource-policy", "same-origin");
         response.insert_header("x-content-type-options", "nosniff");
-        response.insert_header("x-frame-options", "deny");
         Ok(response)
     }
 }
@@ -198,6 +201,8 @@ impl<State: Clone + Send + Sync + 'static> tide::Middleware<State>
                 // "report-to 'none'", // unsupported by a lot of things still, but mozilla's saying report-uri is deprecated?
                 "report-uri 'none'",
                 "base-uri 'self'",
+                // nobody wants to be in a frame
+                "frame-ancestors 'none'",
             ]
             .join(";"),
         );

kanidmd/score/src/https/mod.rs

@@ -189,7 +189,7 @@ pub fn to_tide_response<T: Serialize>(
 async fn robots_txt(_req: tide::Request<AppState>) -> tide::Result {
     let mut res = tide::Response::new(200);
 
-    res.set_content_type("text/plain");
+    res.set_content_type("text/plain;charset=utf-8");
     res.set_body(
         r#"
 User-agent: *