rede5/saveinmed
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge pull request #22 from rede5/codex/fix-content-security-policy-violations

Browse source 
Relax Content-Security-Policy for Swagger UI under /docs
This commit is contained in:
Tiago Yamamoto 2025-12-21 22:10:19 -03:00 committed by GitHub
commit f71a3a320a
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 12 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

16
backend/internal/http/middleware/security.go
View file

@ -1,16 +1,24 @@
package middleware package middleware
import "net/http" import (
"net/http"
"strings"
)
func SecurityHeaders(next http.Handler) http.Handler { func SecurityHeaders(next http.Handler) http.Handler {
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
isDocsRequest := strings.HasPrefix(r.URL.Path, "/docs/")
w.Header().Set("X-Content-Type-Options", "nosniff") w.Header().Set("X-Content-Type-Options", "nosniff")
w.Header().Set("X-Frame-Options", "DENY") w.Header().Set("X-Frame-Options", "DENY")
w.Header().Set("X-XSS-Protection", "1; mode=block") w.Header().Set("X-XSS-Protection", "1; mode=block")
w.Header().Set("Referrer-Policy", "strict-origin-when-cross-origin") w.Header().Set("Referrer-Policy", "strict-origin-when-cross-origin")
// Content-Security-Policy can be very strict, maybe good to start lenient or specific. if isDocsRequest {
// For an API, it's less critical than a frontend serving HTML, but good practice. w.Header().Set("Content-Security-Policy", "default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self' data:; connect-src 'self'")
w.Header().Set("Content-Security-Policy", "default-src 'none'") } else {
// Content-Security-Policy can be very strict, maybe good to start lenient or specific.
// For an API, it's less critical than a frontend serving HTML, but good practice.
w.Header().Set("Content-Security-Policy", "default-src 'none'")
}
w.Header().Set("Cache-Control", "no-store, max-age=0") w.Header().Set("Cache-Control", "no-store, max-age=0")
next.ServeHTTP(w, r) next.ServeHTTP(w, r)