Initial commit

express/config/helmet.js

@@ -0,0 +1,41 @@
+const crypto = require('crypto')
+
+module.exports = {
+  contentSecurityPolicy: {
+    useDefaults: false,
+    directives: {
+      defaultSrc: ["'none'"],
+      objectSrc: ["'none'"],
+      baseUri: ["'none'"],
+      scriptSrc: [
+        generateCspNonce,
+        "'strict-dynamic'",
+        'https:',
+        "'unsafe-inline'"
+      ],
+      connectSrc: ["'self'"],
+      styleSrc: ["'self'", 'https:', "'unsafe-inline'"],
+      fontSrc: ["'self'", 'https:'],
+      imgSrc: ["'self'", 'data:'],
+      // Disabled TT due to jQuery using sink functions and trying to sanitize
+      // produced HTML with DOMPurify breaks functionality of summernote.
+      // requireTrustedTypesFor: ["'script'"],
+      reportUri: ['/api/v1/system/csp-reports']
+    }
+  },
+
+  referrerPolicy: {
+    policy: ['no-referrer', 'strict-origin-when-cross-origin']
+  }
+}
+
+// TODO CSP nonce is generated for every request.
+// It would only really be needed (CSP in general) for the ones which return HTML documents
+// and not for all the other (static) resources (styles, scrips, images, ...)
+// Consider: caching static resources, using hash based policy instead of nonce or other ...
+
+function generateCspNonce(req, res) {
+  const cspNonce = crypto.randomBytes(16).toString('base64')
+  res.locals.cspNonce = cspNonce
+  return `'nonce-${cspNonce}'`
+}

express/config/keys.js

@@ -0,0 +1,11 @@
+module.exports = {
+  isBehindProxy: process.env.IS_BEHIND_PROXY === 'true',
+  secret: process.env.SECRET,
+  cookiesSecure: process.env.COOKIES_SECURE === 'true',
+  smtpHost: process.env.SMTP_HOST,
+  smtpPort: process.env.SMTP_PORT,
+  smtpTlsRejectUnauthorized:
+    process.env.SMTP_TLS_REJECT_UNAUTHORIZED === 'true',
+  smtpFrom: process.env.SMTP_FROM,
+  origin: process.env.ORIGIN
+}

express/config/settings.js

@@ -0,0 +1,22 @@
+const { cookiesSecure } = require('../config/keys')
+
+// Duration of validity of a remember me token. 1 year.
+const REMEMBER_ME_DURATION_JS = 365 * 24 * 60 * 60 * 1000
+exports.REMEMBER_ME_DURATION_SQL = '365 days'
+
+exports.rememberMeCookieSettings = {
+  httpOnly: true,
+  maxAge: REMEMBER_ME_DURATION_JS,
+  secure: cookiesSecure,
+  signed: true,
+  sameSite: 'lax'
+}
+
+exports.DEFAULT_HITS_PER_PAGE = 10
+
+exports.EDITOR_MAX_HITS = 10000
+
+// If you change this one, don't forget to also update the volume mount in docker-compose.prod.yml.
+exports.DATA_FILES_PATH = 'data_files'
+
+exports.MAX_EXTRACTIONS_PER_USER = 5