mart-w/kanidm
1
0
Fork 0
mirror of https://github.com/kanidm/kanidm.git synced 2025-02-23 20:47:01 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

tweaks to CSP headers, adding more docs

Browse source
This commit is contained in:
James Hodgkinson 2022-06-22 09:54:48 +10:00
parent dc42bd9ee8
commit febabf4b56
1 changed files with 20 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

25
kanidmd/score/src/https/mod.rs
View file

@ -281,13 +281,28 @@ impl<State: Clone + Send + Sync + 'static> tide::Middleware<State>
let body_str = response.take_body().into_string().await?;
// update it with the hash
response.set_body(body_str.replace("==WASMHASH==", self.integrity_wasmloader.as_str()));
response.insert_header(
/* content-security-policy headers tell the browser what to trust
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy
In this case we're only trusting the same server that the page is being loaded from, and adding
a hash of wasmloader.js, which is the main script we should be loading, and should be really secure
about that!
*/
// TODO: consider scraping the other js files that wasm-pack builds and including them too
"content-security-policy",
format!(
"default-src https: self; img-src https: self; script-src https: 'sha384-{}' 'unsafe-eval' self;",
self.integrity_wasmloader.as_str(),
)
vec![
"default-src 'self'",
// we need unsafe-eval because of WASM things
format!("script-src 'self' 'sha384-{}' 'unsafe-eval'", self.integrity_wasmloader.as_str() ).as_str(),
"img-src 'self'",
"object-src 'self'",
// not currently using workers so it can be blocked
"worker-src 'none'",
].join(";"),
);
Ok(response)