66 lines
2.2 KiB
Go
66 lines
2.2 KiB
Go
// Keywarden - Centralized SSH Key Management and Deployment
|
||
// Copyright (C) 2026 Patrick Asmus (scriptos)
|
||
// SPDX-License-Identifier: AGPL-3.0-or-later
|
||
|
||
package security
|
||
|
||
import (
|
||
"net/http"
|
||
)
|
||
|
||
// HeadersMiddleware returns middleware that sets security-relevant HTTP
|
||
// response headers on every response.
|
||
//
|
||
// These headers protect against clickjacking, MIME-sniffing, information
|
||
// leakage and other common web attacks. They are set regardless of
|
||
// whether TLS is in use.
|
||
func HeadersMiddleware() func(http.Handler) http.Handler {
|
||
return func(next http.Handler) http.Handler {
|
||
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
||
h := w.Header()
|
||
|
||
// Prevent the page from being embedded in an iframe (clickjacking)
|
||
h.Set("X-Frame-Options", "DENY")
|
||
|
||
// Stop browsers from MIME-sniffing the content type
|
||
h.Set("X-Content-Type-Options", "nosniff")
|
||
|
||
// Control what information is sent in the Referer header
|
||
h.Set("Referrer-Policy", "strict-origin-when-cross-origin")
|
||
|
||
// Restrict browser features that are not needed
|
||
h.Set("Permissions-Policy", "camera=(), microphone=(), geolocation=(), payment=()")
|
||
|
||
// Content Security Policy – fairly strict but allows inline
|
||
// styles/scripts that Tabler and the app currently use.
|
||
h.Set("Content-Security-Policy",
|
||
"default-src 'self'; "+
|
||
"script-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net; "+
|
||
"style-src 'self' 'unsafe-inline'; "+
|
||
"img-src 'self' data:; "+
|
||
"font-src 'self' data:; "+
|
||
"connect-src 'self'; "+
|
||
"frame-ancestors 'none'; "+
|
||
"form-action 'self'; "+
|
||
"base-uri 'self'")
|
||
|
||
// Opt out of Google FLoC / Topics
|
||
h.Set("X-Permitted-Cross-Domain-Policies", "none")
|
||
|
||
// Cache control for authenticated pages – prevent caching of
|
||
// sensitive data. Static assets set their own cache headers.
|
||
if r.URL.Path != "" && !isStaticAsset(r.URL.Path) {
|
||
h.Set("Cache-Control", "no-store, no-cache, must-revalidate, private")
|
||
h.Set("Pragma", "no-cache")
|
||
}
|
||
|
||
next.ServeHTTP(w, r)
|
||
})
|
||
}
|
||
}
|
||
|
||
// isStaticAsset returns true for paths that serve static files.
|
||
func isStaticAsset(path string) bool {
|
||
return len(path) > 8 && (path[:8] == "/static/" || path[:8] == "/avatar/")
|
||
}
|