awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-09-22 13:39:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Properly added pwndpasswords API to CSP

Browse Source
This commit is contained in:
Joel Biddle
2023-08-22 17:58:10 +10:00
parent 196beb8355
commit e288402ec4
2 changed files with 26 additions and 35 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
backend/src/index.ts
View File

@@ -132,16 +132,7 @@ const main = async () => {
// in production
app.disable("x-powered-by");
app.use(apiLimiter);
app.use(
helmet.contentSecurityPolicy({
useDefaults: true,
directives: {
defaultSrc: ["'self'"],
imgSrc: ["*", "data:"],
connectSrc: ["'self'", "https://api.pwnedpasswords.com/range/"]
}
})
);
app.use(helmet());
}
app.use((req, res, next) => {

50
frontend/next.config.js
View File

@@ -3,7 +3,7 @@
/**
* @type {import('next').NextConfig}
**/
const path = require('path');
const path = require("path");
const ContentSecurityPolicy = `
default-src 'self';
@@ -11,7 +11,7 @@ const ContentSecurityPolicy = `
style-src 'self' https://rsms.me 'unsafe-inline';
child-src https://api.stripe.com;
frame-src https://js.stripe.com/ https://api.stripe.com https://www.youtube.com/;
connect-src 'self' wss://nexus-websocket-a.intercom.io https://api-iam.intercom.io https://api.heroku.com/ https://id.heroku.com/oauth/authorize https://id.heroku.com/oauth/token https://checkout.stripe.com https://app.posthog.com https://api.stripe.com http://localhost:*;
connect-src 'self' wss://nexus-websocket-a.intercom.io https://api-iam.intercom.io https://api.heroku.com/ https://id.heroku.com/oauth/authorize https://id.heroku.com/oauth/token https://checkout.stripe.com https://app.posthog.com https://api.stripe.com https://api.pwnedpasswords.com http://localhost:*;
img-src 'self' https://static.intercomassets.com https://js.intercomcdn.com https://downloads.intercomcdn.com https://*.stripe.com https://i.ytimg.com/ data:;
media-src https://js.intercomcdn.com;
font-src 'self' https://fonts.intercomcdn.com/ https://maxcdn.bootstrapcdn.com https://rsms.me https://fonts.gstatic.com;
@@ -21,50 +21,50 @@ const ContentSecurityPolicy = `
// after learning more below.
const securityHeaders = [
{
key: 'X-DNS-Prefetch-Control',
value: 'on'
key: "X-DNS-Prefetch-Control",
value: "on"
},
{
key: 'Strict-Transport-Security',
value: 'max-age=63072000; includeSubDomains; preload'
key: "Strict-Transport-Security",
value: "max-age=63072000; includeSubDomains; preload"
},
{
key: 'X-XSS-Protection',
value: '1; mode=block'
key: "X-XSS-Protection",
value: "1; mode=block"
},
{
key: 'X-Frame-Options',
value: 'SAMEORIGIN'
key: "X-Frame-Options",
value: "SAMEORIGIN"
},
{
key: 'Permissions-Policy',
value: 'camera=(), microphone=()'
key: "Permissions-Policy",
value: "camera=(), microphone=()"
},
{
key: 'X-Content-Type-Options',
value: 'nosniff'
key: "X-Content-Type-Options",
value: "nosniff"
},
{
key: 'Referrer-Policy',
value: 'strict-origin-when-cross-origin'
key: "Referrer-Policy",
value: "strict-origin-when-cross-origin"
},
{
key: 'Content-Security-Policy',
value: ContentSecurityPolicy.replace(/\s{2,}/g, ' ').trim()
key: "Content-Security-Policy",
value: ContentSecurityPolicy.replace(/\s{2,}/g, " ").trim()
}
];
module.exports = {
output: 'standalone',
output: "standalone",
i18n: {
locales: ['en', 'ko', 'fr', 'pt-BR', 'pt-PT', 'es'],
defaultLocale: 'en'
locales: ["en", "ko", "fr", "pt-BR", "pt-PT", "es"],
defaultLocale: "en"
},
async headers() {
return [
{
// Apply these headers to all routes in your application.
source: '/:path*',
source: "/:path*",
headers: securityHeaders
}
];
@@ -73,15 +73,15 @@ module.exports = {
// config
config.module.rules.push({
test: /\.wasm$/,
loader: 'base64-loader',
type: 'javascript/auto'
loader: "base64-loader",
type: "javascript/auto"
});
config.module.noParse = /\.wasm$/;
config.module.rules.forEach((rule) => {
(rule.oneOf || []).forEach((oneOf) => {
if (oneOf.loader && oneOf.loader.indexOf('file-loader') >= 0) {
if (oneOf.loader && oneOf.loader.indexOf("file-loader") >= 0) {
oneOf.exclude.push(/\.wasm$/);
}
});