From 561faa59cffcdacbc9fcd5291d347a049cc5ba7b Mon Sep 17 00:00:00 2001 From: Odyssey Date: Wed, 8 Feb 2023 17:37:42 +0100 Subject: [PATCH] Massive security improvement: Add security headers (fixes #51) Signed-off-by: Odyssey --- serve/serve.go | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/serve/serve.go b/serve/serve.go index 4d97bea..9f49a6e 100644 --- a/serve/serve.go +++ b/serve/serve.go @@ -80,6 +80,18 @@ func Serve() { MaxAge: 31536000, } + // add global headers + app.Use(func(c *fiber.Ctx) error { + c.Set("X-Frame-Options", "SAMEORIGIN") + c.Set("X-XSS-Protection", "1; mode=block") + c.Set("X-Content-Type-Options", "nosniff") + c.Set("Referrer-Policy", "no-referrer") + c.Set("Content-Security-Policy", "default-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval';") + c.Set("Strict-Transport-Security", "max-age=31536000; includeSubDomains; preload") + + return c.Next() + }) + app.Get("/", pages.HandleIndex) app.Static("/css", "./public/css", staticConfig) app.Static("/fonts", "./public/fonts", staticConfig)