Ed Tanous | 8041f31 | 2017-04-03 09:47:01 -0700 | [diff] [blame] | 1 | #pragma once |
| 2 | |
| 3 | #include <crow/http_request.h> |
| 4 | #include <crow/http_response.h> |
| 5 | |
Ed Tanous | 1abe55e | 2018-09-05 08:30:59 -0700 | [diff] [blame] | 6 | namespace crow |
| 7 | { |
Ed Tanous | 1abe55e | 2018-09-05 08:30:59 -0700 | [diff] [blame] | 8 | struct SecurityHeadersMiddleware |
| 9 | { |
| 10 | struct Context |
| 11 | { |
| 12 | }; |
Ed Tanous | 8041f31 | 2017-04-03 09:47:01 -0700 | [diff] [blame] | 13 | |
Ed Tanous | 1abe55e | 2018-09-05 08:30:59 -0700 | [diff] [blame] | 14 | void beforeHandle(crow::Request& req, Response& res, Context& ctx) |
| 15 | { |
Ed Tanous | fd828ba | 2018-08-09 10:58:08 -0700 | [diff] [blame] | 16 | #ifdef BMCWEB_INSECURE_DISABLE_XSS_PREVENTION |
Ed Tanous | 1abe55e | 2018-09-05 08:30:59 -0700 | [diff] [blame] | 17 | if ("OPTIONS"_method == req.method()) |
| 18 | { |
| 19 | res.end(); |
| 20 | } |
| 21 | #endif |
Ed Tanous | fd828ba | 2018-08-09 10:58:08 -0700 | [diff] [blame] | 22 | } |
Ed Tanous | 8041f31 | 2017-04-03 09:47:01 -0700 | [diff] [blame] | 23 | |
Ed Tanous | 1abe55e | 2018-09-05 08:30:59 -0700 | [diff] [blame] | 24 | void afterHandle(Request& req, Response& res, Context& ctx) |
| 25 | { |
| 26 | /* |
| 27 | TODO(ed) these should really check content types. for example, |
| 28 | X-UA-Compatible header doesn't make sense when retrieving a JSON or |
| 29 | javascript file. It doesn't hurt anything, it's just ugly. |
| 30 | */ |
Ed Tanous | 750ceae | 2018-11-30 15:02:22 -0800 | [diff] [blame] | 31 | using bf = boost::beast::http::field; |
| 32 | res.addHeader(bf::strict_transport_security, "max-age=31536000; " |
| 33 | "includeSubdomains; " |
| 34 | "preload"); |
| 35 | res.addHeader(bf::x_frame_options, "DENY"); |
| 36 | |
| 37 | res.addHeader(bf::pragma, "no-cache"); |
| 38 | res.addHeader(bf::cache_control, "no-Store,no-Cache"); |
Ed Tanous | 3eb2f35 | 2018-12-20 12:30:45 -0800 | [diff] [blame] | 39 | |
| 40 | // The KVM currently needs to load images from base64 encoded strings. |
| 41 | // img-src 'self' data: is used to allow that. |
| 42 | // https://stackoverflow.com/questions/18447970/content-security-policy-data-not-working-for-base64-images-in-chrome-28 |
| 43 | res.addHeader("Content-Security-Policy", |
| 44 | "default-src 'self'; img-src 'self' data:"); |
Ed Tanous | 750ceae | 2018-11-30 15:02:22 -0800 | [diff] [blame] | 45 | res.addHeader("X-XSS-Protection", "1; " |
| 46 | "mode=block"); |
Ed Tanous | 02db306 | 2018-12-10 13:37:44 -0800 | [diff] [blame] | 47 | res.addHeader("X-Content-Type-Options", "nosniff"); |
Ed Tanous | 750ceae | 2018-11-30 15:02:22 -0800 | [diff] [blame] | 48 | res.addHeader("X-UA-Compatible", "IE=11"); |
Ed Tanous | fd828ba | 2018-08-09 10:58:08 -0700 | [diff] [blame] | 49 | |
| 50 | #ifdef BMCWEB_INSECURE_DISABLE_XSS_PREVENTION |
| 51 | |
Ed Tanous | 750ceae | 2018-11-30 15:02:22 -0800 | [diff] [blame] | 52 | res.addHeader(bf::access_control_allow_origin, "http://localhost:8080"); |
| 53 | res.addHeader(bf::access_control_allow_methods, "GET, " |
| 54 | "POST, " |
| 55 | "PUT, " |
Ed Tanous | da7f41e | 2018-12-10 13:36:40 -0800 | [diff] [blame] | 56 | "PATCH, " |
| 57 | "DELETE"); |
Ed Tanous | 750ceae | 2018-11-30 15:02:22 -0800 | [diff] [blame] | 58 | res.addHeader(bf::access_control_allow_credentials, "true"); |
| 59 | res.addHeader(bf::access_control_allow_headers, "Origin, " |
| 60 | "Content-Type, " |
| 61 | "Accept, " |
| 62 | "Cookie, " |
| 63 | "X-XSRF-TOKEN"); |
Ed Tanous | fd828ba | 2018-08-09 10:58:08 -0700 | [diff] [blame] | 64 | |
| 65 | #endif |
Ed Tanous | 1abe55e | 2018-09-05 08:30:59 -0700 | [diff] [blame] | 66 | } |
Ed Tanous | 8041f31 | 2017-04-03 09:47:01 -0700 | [diff] [blame] | 67 | }; |
Ed Tanous | 1abe55e | 2018-09-05 08:30:59 -0700 | [diff] [blame] | 68 | } // namespace crow |