Feliday/Feliday-UI
5
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Revert "Set content security policy http header for all responses (#608)" (#613)

Browse source 
This reverts commit f1c5c60c76.
This commit is contained in:
Dessalines 2022-04-08 13:52:16 +00:00 committed by GitHub
parent 052438f39a
commit 7d8843902a
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 13 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

20
src/server/index.tsx
View file

@ -27,13 +27,6 @@ const [hostname, port] = process.env["LEMMY_UI_HOST"]
const extraThemesFolder = const extraThemesFolder =
process.env["LEMMY_UI_EXTRA_THEMES_FOLDER"] || "./extra_themes"; process.env["LEMMY_UI_EXTRA_THEMES_FOLDER"] || "./extra_themes";
server.use(function (_req, res, next) {
res.setHeader(
"Content-Security-Policy",
"default-src data: 'self'; connect-src * ws: wss:; frame-src *; img-src * data:; script-src 'self'; style-src 'self' 'unsafe-inline'; manifest-src 'self'"
);
next();
});
server.use(express.json()); server.use(express.json());
server.use(express.urlencoded({ extended: false })); server.use(express.urlencoded({ extended: false }));
server.use("/static", express.static(path.resolve("./dist"))); server.use("/static", express.static(path.resolve("./dist")));
@ -171,8 +164,18 @@ server.get("/*", async (req, res) => {
return res.redirect(context.url); return res.redirect(context.url);
} }
const cspHtml = (
<meta
http-equiv="Content-Security-Policy"
content="default-src data: 'self'; connect-src * ws: wss:; frame-src *; img-src * data:; script-src 'self'; style-src 'self' 'unsafe-inline'; manifest-src 'self'"
/>
);
const root = renderToString(wrapper); const root = renderToString(wrapper);
const symbols = renderToString(SYMBOLS); const symbols = renderToString(SYMBOLS);
const cspStr = process.env.LEMMY_EXTERNAL_HOST
? renderToString(cspHtml)
: "";
const helmet = Helmet.renderStatic(); const helmet = Helmet.renderStatic();
const config: ILemmyConfig = { wsHost: process.env.LEMMY_WS_HOST }; const config: ILemmyConfig = { wsHost: process.env.LEMMY_WS_HOST };
@ -197,6 +200,9 @@ server.get("/*", async (req, res) => {
<meta charset="utf-8"> <meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">
<!-- Content Security Policy -->
${cspStr}
<!-- Web app manifest --> <!-- Web app manifest -->
<link rel="manifest" href="/static/assets/manifest.webmanifest"> <link rel="manifest" href="/static/assets/manifest.webmanifest">