From 394dafde01484d8d478f7c9d8801fa99ae9e4a05 Mon Sep 17 00:00:00 2001 From: James Elliott Date: Sat, 9 Jul 2022 12:00:21 +1000 Subject: [PATCH] refactor(server): factorize and improve csp (#3509) --- internal/server/const.go | 5 ++--- internal/server/template.go | 4 ++-- 2 files changed, 4 insertions(+), 5 deletions(-) diff --git a/internal/server/const.go b/internal/server/const.go index 098a5bea8..ae815cd45 100644 --- a/internal/server/const.go +++ b/internal/server/const.go @@ -59,7 +59,6 @@ X_AUTHELIA_HEALTHCHECK_PATH=%s ` const ( - cspDefaultTemplate = "default-src 'self'; object-src 'none'; style-src 'self' 'nonce-%s'" - cspDefaultDevTemplate = "default-src 'self' 'unsafe-eval'; object-src 'none'; style-src 'self' 'nonce-%s'" - cspNoncePlaceholder = "${NONCE}" + cspDefaultTemplate = "default-src 'self'%s; frame-src 'none'; object-src 'none'; style-src 'self' 'nonce-%s'; frame-ancestors 'none'; base-uri 'self'" + cspNoncePlaceholder = "${NONCE}" ) diff --git a/internal/server/template.go b/internal/server/template.go index 31b812500..9c5bb523d 100644 --- a/internal/server/template.go +++ b/internal/server/template.go @@ -76,9 +76,9 @@ func ServeTemplatedFile(publicDir, file, assetPath, duoSelfEnrollment, rememberM case ctx.Configuration.Server.Headers.CSPTemplate != "": ctx.Response.Header.Add("Content-Security-Policy", strings.ReplaceAll(ctx.Configuration.Server.Headers.CSPTemplate, cspNoncePlaceholder, nonce)) case os.Getenv("ENVIRONMENT") == dev: - ctx.Response.Header.Add("Content-Security-Policy", fmt.Sprintf(cspDefaultDevTemplate, nonce)) + ctx.Response.Header.Add("Content-Security-Policy", fmt.Sprintf(cspDefaultTemplate, " 'unsafe-eval'", nonce)) default: - ctx.Response.Header.Add("Content-Security-Policy", fmt.Sprintf(cspDefaultTemplate, nonce)) + ctx.Response.Header.Add("Content-Security-Policy", fmt.Sprintf(cspDefaultTemplate, "", nonce)) } err := tmpl.Execute(ctx.Response.BodyWriter(), struct{ Base, BaseURL, CSPNonce, DuoSelfEnrollment, LogoOverride, RememberMe, ResetPassword, ResetPasswordCustomURL, Session, Theme string }{Base: base, BaseURL: baseURL, CSPNonce: nonce, DuoSelfEnrollment: duoSelfEnrollment, LogoOverride: logoOverride, RememberMe: rememberMe, ResetPassword: resetPassword, ResetPasswordCustomURL: resetPasswordCustomURL, Session: session, Theme: theme})