From a4cb6f530845d3101df456723b696dd04d9a9bf1 Mon Sep 17 00:00:00 2001 From: perennial Date: Wed, 14 Feb 2024 16:17:13 +1100 Subject: [PATCH 1/4] Remove deprecated X-XSS-Protection header --- main.go | 1 - 1 file changed, 1 deletion(-) diff --git a/main.go b/main.go index fcee75e..ac7eb50 100644 --- a/main.go +++ b/main.go @@ -128,7 +128,6 @@ func main() { // Global headers (from GotHub) server.Use(func(c *fiber.Ctx) error { c.Set("X-Frame-Options", "SAMEORIGIN") - c.Set("X-XSS-Protection", "1; mode=block") c.Set("X-Content-Type-Options", "nosniff") c.Set("Referrer-Policy", "no-referrer") c.Set("Strict-Transport-Security", "max-age=31536000; includeSubDomains; preload") From ec510ea563cc36248f364955b1d0053489d0a1f6 Mon Sep 17 00:00:00 2001 From: perennial Date: Wed, 14 Feb 2024 16:28:35 +1100 Subject: [PATCH 2/4] Remove redundant HTML meta tags --- views/layout.jet.html | 2 -- 1 file changed, 2 deletions(-) diff --git a/views/layout.jet.html b/views/layout.jet.html index 495cbea..694c40c 100644 --- a/views/layout.jet.html +++ b/views/layout.jet.html @@ -7,8 +7,6 @@ - - From 04389820d4888cdcf96b071ce343304152529f7f Mon Sep 17 00:00:00 2001 From: perennial Date: Wed, 14 Feb 2024 21:51:59 +1100 Subject: [PATCH 3/4] Set Content-Security-Policy header --- main.go | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/main.go b/main.go index ac7eb50..aa4b416 100644 --- a/main.go +++ b/main.go @@ -125,12 +125,15 @@ func main() { }, })) - // Global headers (from GotHub) + // Global HTTP headers server.Use(func(c *fiber.Ctx) error { c.Set("X-Frame-Options", "SAMEORIGIN") c.Set("X-Content-Type-Options", "nosniff") c.Set("Referrer-Policy", "no-referrer") c.Set("Strict-Transport-Security", "max-age=31536000; includeSubDomains; preload") + // -- Allowing inline styles may be simpler and avoid breakage, but you lose a lot of the protection that CSP provides + // src: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/style-src#unsafe_inline_styles + c.Set("Content-Security-Policy", "default-src 'none'; script-src 'self' 'sha256-hyWmaJx4D/wwnSlHuylUcUEAHy4waDmxU5jgvi3ilCs='; style-src 'self' 'unsafe-inline'; img-src 'self' https:; connect-src 'self'; frame-ancestors 'none'; object-src 'none'") return c.Next() }) From c5a4ddf5a2967f4a7aa0148d6c3132d7275c62ca Mon Sep 17 00:00:00 2001 From: perennial Date: Thu, 15 Feb 2024 19:22:02 +1100 Subject: [PATCH 4/4] Change frame-ancestors to 'self' --- main.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/main.go b/main.go index aa4b416..365c5e6 100644 --- a/main.go +++ b/main.go @@ -133,7 +133,7 @@ func main() { c.Set("Strict-Transport-Security", "max-age=31536000; includeSubDomains; preload") // -- Allowing inline styles may be simpler and avoid breakage, but you lose a lot of the protection that CSP provides // src: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/style-src#unsafe_inline_styles - c.Set("Content-Security-Policy", "default-src 'none'; script-src 'self' 'sha256-hyWmaJx4D/wwnSlHuylUcUEAHy4waDmxU5jgvi3ilCs='; style-src 'self' 'unsafe-inline'; img-src 'self' https:; connect-src 'self'; frame-ancestors 'none'; object-src 'none'") + c.Set("Content-Security-Policy", "default-src 'none'; script-src 'self' 'sha256-hyWmaJx4D/wwnSlHuylUcUEAHy4waDmxU5jgvi3ilCs='; style-src 'self' 'unsafe-inline'; img-src 'self' https:; connect-src 'self'; frame-ancestors 'self'; object-src 'none'") return c.Next() })