incremental
diff --git a/include/security_headers_middleware.hpp b/include/security_headers_middleware.hpp
index 7e84543..19644f4 100644
--- a/include/security_headers_middleware.hpp
+++ b/include/security_headers_middleware.hpp
@@ -4,12 +4,45 @@
#include <crow/http_response.h>
namespace crow {
+static const std::string strict_transport_security_key =
+ "Strict-Transport-Security";
+static const std::string strict_transport_security_value =
+ "max-age=31536000; includeSubdomains; preload";
+
+static const std::string ua_compatability_key = "X-UA-Compatible";
+static const std::string ua_compatability_value = "IE=11";
+
+static const std::string xframe_key = "X-Frame-Options";
+static const std::string xframe_value = "DENY";
+
+static const std::string xss_key = "X-XSS-Protection";
+static const std::string xss_value = "1; mode=block";
+
+static const std::string content_security_key = "X-Content-Security-Policy";
+static const std::string content_security_value = "default-src 'self'";
+
struct SecurityHeadersMiddleware {
struct context {};
- void before_handle(crow::request& req, response& res, context& ctx);
+ void before_handle(crow::request& req,
+ response& res,
+ context& ctx) {}
- void after_handle(request& req, response& res, context& ctx);
+ void after_handle(request& /*req*/,
+ response& res,
+ context& ctx) {
+ /*
+ TODO(ed) these should really check content types. for example,
+ X-UA-Compatible header doesn't make sense when retrieving a JSON or
+ javascript file. It doesn't hurt anything, it's just ugly.
+ */
+ res.add_header(strict_transport_security_key,
+ strict_transport_security_value);
+ res.add_header(ua_compatability_key, ua_compatability_value);
+ res.add_header(xframe_key, xframe_value);
+ res.add_header(xss_key, xss_value);
+ res.add_header(content_security_key, content_security_value);
+ }
};
}
\ No newline at end of file