34 lines
1.0 KiB
Go
34 lines
1.0 KiB
Go
package middleware
|
|
|
|
import "net/http"
|
|
|
|
const contentSecurityPolicy = "default-src 'self'; " +
|
|
"script-src 'self' 'wasm-unsafe-eval'; " +
|
|
"style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; " +
|
|
"font-src 'self' https://fonts.gstatic.com; " +
|
|
"img-src 'self' data: blob: https:; " +
|
|
"connect-src 'self'; " +
|
|
"object-src 'none'; " +
|
|
"base-uri 'self'; " +
|
|
"form-action 'self'; " +
|
|
"frame-ancestors 'none'"
|
|
|
|
const strictTransportSecurity = "max-age=31536000"
|
|
|
|
func SecurityHeaders(hsts bool) func(http.Handler) http.Handler {
|
|
return func(next http.Handler) http.Handler {
|
|
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
h := w.Header()
|
|
h.Set("Content-Security-Policy", contentSecurityPolicy)
|
|
h.Set("X-Content-Type-Options", "nosniff")
|
|
h.Set("X-Frame-Options", "DENY")
|
|
h.Set("Referrer-Policy", "strict-origin-when-cross-origin")
|
|
h.Set("Cross-Origin-Opener-Policy", "same-origin")
|
|
if hsts {
|
|
h.Set("Strict-Transport-Security", strictTransportSecurity)
|
|
}
|
|
next.ServeHTTP(w, r)
|
|
})
|
|
}
|
|
}
|