42 lines
1.3 KiB
JavaScript
42 lines
1.3 KiB
JavaScript
const crypto = require('crypto')
|
|
|
|
module.exports = {
|
|
contentSecurityPolicy: {
|
|
useDefaults: false,
|
|
directives: {
|
|
defaultSrc: ["'none'"],
|
|
objectSrc: ["'none'"],
|
|
baseUri: ["'none'"],
|
|
scriptSrc: [
|
|
generateCspNonce,
|
|
"'strict-dynamic'",
|
|
'https:',
|
|
"'unsafe-inline'"
|
|
],
|
|
connectSrc: ["'self'"],
|
|
styleSrc: ["'self'", 'https:', "'unsafe-inline'"],
|
|
fontSrc: ["'self'", 'https:'],
|
|
imgSrc: ["'self'", 'data:'],
|
|
// Disabled TT due to jQuery using sink functions and trying to sanitize
|
|
// produced HTML with DOMPurify breaks functionality of summernote.
|
|
// requireTrustedTypesFor: ["'script'"],
|
|
reportUri: ['/api/v1/system/csp-reports']
|
|
}
|
|
},
|
|
|
|
referrerPolicy: {
|
|
policy: ['no-referrer', 'strict-origin-when-cross-origin']
|
|
}
|
|
}
|
|
|
|
// TODO CSP nonce is generated for every request.
|
|
// It would only really be needed (CSP in general) for the ones which return HTML documents
|
|
// and not for all the other (static) resources (styles, scrips, images, ...)
|
|
// Consider: caching static resources, using hash based policy instead of nonce or other ...
|
|
|
|
function generateCspNonce(req, res) {
|
|
const cspNonce = crypto.randomBytes(16).toString('base64')
|
|
res.locals.cspNonce = cspNonce
|
|
return `'nonce-${cspNonce}'`
|
|
}
|