mart-w/kanidm
1
0
Fork 0
mirror of https://github.com/kanidm/kanidm.git synced 2025-02-23 20:47:01 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

tweaks to CSP headers, adding more docs

Browse source
This commit is contained in:
James Hodgkinson 2022-06-22 09:54:48 +10:00
parent dc42bd9ee8
commit febabf4b56
1 changed files with 20 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

25
kanidmd/score/src/https/mod.rs
View file

@ -281,13 +281,28 @@ impl<State: Clone + Send + Sync + 'static> tide::Middleware<State>
let body_str = response.take_body().into_string().await?; let body_str = response.take_body().into_string().await?;
// update it with the hash // update it with the hash
response.set_body(body_str.replace("==WASMHASH==", self.integrity_wasmloader.as_str())); response.set_body(body_str.replace("==WASMHASH==", self.integrity_wasmloader.as_str()));
response.insert_header( response.insert_header(
/* content-security-policy headers tell the browser what to trust
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy
In this case we're only trusting the same server that the page is being loaded from, and adding
a hash of wasmloader.js, which is the main script we should be loading, and should be really secure
about that!
*/
// TODO: consider scraping the other js files that wasm-pack builds and including them too
"content-security-policy", "content-security-policy",
format!( vec![
"default-src https: self; img-src https: self; script-src https: 'sha384-{}' 'unsafe-eval' self;", "default-src 'self'",
self.integrity_wasmloader.as_str(), // we need unsafe-eval because of WASM things
) format!("script-src 'self' 'sha384-{}' 'unsafe-eval'", self.integrity_wasmloader.as_str() ).as_str(),
"img-src 'self'",
"object-src 'self'",
// not currently using workers so it can be blocked
"worker-src 'none'",
].join(";"),
); );
Ok(response) Ok(response)