blob: 83df24c194e592a3e0d2d5658be5a4375bf85ace [file] [log] [blame]
Ed Tanous8041f312017-04-03 09:47:01 -07001#pragma once
2
3#include <crow/http_request.h>
4#include <crow/http_response.h>
5
Ed Tanous1abe55e2018-09-05 08:30:59 -07006namespace crow
7{
Ed Tanous1abe55e2018-09-05 08:30:59 -07008struct SecurityHeadersMiddleware
9{
10 struct Context
11 {
12 };
Ed Tanous8041f312017-04-03 09:47:01 -070013
Ed Tanous1abe55e2018-09-05 08:30:59 -070014 void beforeHandle(crow::Request& req, Response& res, Context& ctx)
15 {
Ed Tanousfd828ba2018-08-09 10:58:08 -070016#ifdef BMCWEB_INSECURE_DISABLE_XSS_PREVENTION
Ed Tanous1abe55e2018-09-05 08:30:59 -070017 if ("OPTIONS"_method == req.method())
18 {
19 res.end();
20 }
21#endif
Ed Tanousfd828ba2018-08-09 10:58:08 -070022 }
Ed Tanous8041f312017-04-03 09:47:01 -070023
Ed Tanous1abe55e2018-09-05 08:30:59 -070024 void afterHandle(Request& req, Response& res, Context& ctx)
25 {
26 /*
27 TODO(ed) these should really check content types. for example,
28 X-UA-Compatible header doesn't make sense when retrieving a JSON or
29 javascript file. It doesn't hurt anything, it's just ugly.
30 */
Ed Tanous750ceae2018-11-30 15:02:22 -080031 using bf = boost::beast::http::field;
32 res.addHeader(bf::strict_transport_security, "max-age=31536000; "
33 "includeSubdomains; "
34 "preload");
35 res.addHeader(bf::x_frame_options, "DENY");
36
37 res.addHeader(bf::pragma, "no-cache");
38 res.addHeader(bf::cache_control, "no-Store,no-Cache");
Ed Tanous3eb2f352018-12-20 12:30:45 -080039
Ed Tanouse6de21a2019-08-21 12:50:42 -070040 res.addHeader("Content-Security-Policy", "default-src 'none'; "
41 "img-src 'self' data:; "
42 "font-src 'self'; "
43 "style-src 'self'; "
44 "script-src 'self'; "
45 "connect-src 'self' wss:");
46 // The KVM currently needs to load images from base64 encoded
47 // strings. img-src 'self' data: is used to allow that.
Ed Tanous3eb2f352018-12-20 12:30:45 -080048 // https://stackoverflow.com/questions/18447970/content-security-policy-data-not-working-for-base64-images-in-chrome-28
Ed Tanouse6de21a2019-08-21 12:50:42 -070049
Ed Tanous750ceae2018-11-30 15:02:22 -080050 res.addHeader("X-XSS-Protection", "1; "
51 "mode=block");
Ed Tanous02db3062018-12-10 13:37:44 -080052 res.addHeader("X-Content-Type-Options", "nosniff");
Ed Tanousfd828ba2018-08-09 10:58:08 -070053
54#ifdef BMCWEB_INSECURE_DISABLE_XSS_PREVENTION
Ed Tanouse6de21a2019-08-21 12:50:42 -070055 res.addHeader(bf::access_control_allow_origin,
56 req.getHeaderValue("Origin"));
Ed Tanous750ceae2018-11-30 15:02:22 -080057 res.addHeader(bf::access_control_allow_methods, "GET, "
58 "POST, "
59 "PUT, "
Ed Tanousda7f41e2018-12-10 13:36:40 -080060 "PATCH, "
61 "DELETE");
Ed Tanous750ceae2018-11-30 15:02:22 -080062 res.addHeader(bf::access_control_allow_credentials, "true");
63 res.addHeader(bf::access_control_allow_headers, "Origin, "
64 "Content-Type, "
65 "Accept, "
66 "Cookie, "
67 "X-XSRF-TOKEN");
Ed Tanousfd828ba2018-08-09 10:58:08 -070068
69#endif
Ed Tanous1abe55e2018-09-05 08:30:59 -070070 }
Ed Tanous8041f312017-04-03 09:47:01 -070071};
Ed Tanous1abe55e2018-09-05 08:30:59 -070072} // namespace crow