javier
6b6389cb0f
This PR contains the work done to add a `SecurityHeadersMiddleware` middleware that stamps hardened security-related HTTP headers onto every response. To provide further details about the work: * Implemented the `SecurityHeadersMiddleware` middleware, which precomputes headers once from a `Configuration` object and applies them to every response: * _Content-Security-Policy_, * _X-Content-Type-Options_, * _X-Frame-Options_, * _Referrer-Policy_, * _Permissions-Policy_, * _Strict-Transport-Security_ (optional). * Integrated this middleware into the router (near the top of the chain), reading each value from configuration with hardened defaults. * The _Strict-Transport-Security_ has no default value — omitted unless explicitly set, so it stays off in plain-HTTP during development and on only behind TLS. * Added security-header constants keys and values. Reviewed-on: rock-n-code/loud-amsterdam#8 Co-authored-by: Javier Cicchelli <javier@rock-n-code.com> Co-committed-by: Javier Cicchelli <javier@rock-n-code.com>
33 lines
1.8 KiB
Swift
33 lines
1.8 KiB
Swift
extension String {
|
|
/// A namespace for well-known path string constants.
|
|
public enum Path {
|
|
/// The directory, relative to the working directory, that the website's static files are served from.
|
|
public static let staticResources = "Resources/Static"
|
|
}
|
|
/// A namespace for the security headers' default configuration values.
|
|
///
|
|
/// `Strict-Transport-Security` is intentionally absent: it is only safe over HTTPS and is
|
|
/// "sticky" in browsers, so it stays off unless explicitly configured in production.
|
|
public enum Security {
|
|
/// The default `Content-Security-Policy`.
|
|
///
|
|
/// Restricts every resource to the site's own origin. `style-src` additionally allows
|
|
/// `'unsafe-inline'` because ``ErrorPage`` ships an inline `<style>` block; remove it once
|
|
/// the error page's styles move to an external stylesheet.
|
|
public static let contentSecurityPolicy = "default-src 'self'; style-src 'self' 'unsafe-inline'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'"
|
|
/// The default `X-Content-Type-Options` (disables MIME sniffing).
|
|
public static let contentTypeOptions = "nosniff"
|
|
/// The default `X-Frame-Options` (forbids framing the page).
|
|
public static let frameOptions = "DENY"
|
|
/// The default `Referrer-Policy`.
|
|
public static let referrerPolicy = "strict-origin-when-cross-origin"
|
|
/// The default `Permissions-Policy` (denies access to powerful browser features the site does not use).
|
|
public static let permissionsPolicy = "accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=()"
|
|
}
|
|
/// A namespace for the server string constants.
|
|
public enum Server {
|
|
/// The website server's name.
|
|
public static let name = "LoudWebsite"
|
|
}
|
|
}
|