mentos1386/send
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

add configs to handle content-security-policy correctly for custom fxa urls

Browse source
This commit is contained in:
jackyzy823 2020-06-11 21:57:48 +08:00
parent 5fb9e395d5
commit e2876b119d
2 changed files with 41 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

20
server/config.js
View file

@ -145,6 +145,26 @@ const conf = convict({
default: 'https://identity.mozilla.com/apps/send',
env: 'FXA_KEY_SCOPE'
},
fxa_csp_oauth_url: {
format: String,
default: '',
env: 'FXA_CSP_OAUTH_URL'
},
fxa_csp_content_url: {
format: String,
default: '',
env: 'FXA_CSP_CONTENT_URL'
},
fxa_csp_profile_url: {
format: String,
default: '',
env: 'FXA_CSP_PROFILE_URL'
},
fxa_csp_profileimage_url: {
format: String,
default: '',
env: 'FXA_CSP_PROFILEIMAGE_URL'
},
survey_url: {
format: String,
default: '',

24
server/routes/index.js
View file

@ -31,8 +31,7 @@ module.exports = function(app) {
next();
});
if (!IS_DEV) {
app.use(
helmet.contentSecurityPolicy({
let csp = {
directives: {
defaultSrc: ["'self'"],
connectSrc: [
@ -62,9 +61,28 @@ module.exports = function(app) {
objectSrc: ["'none'"],
reportUri: '/__cspreport__'
}
})
}
csp.directives.connectSrc.push(config.base_url.replace(/^https:\/\//,'wss://'))
if(config.fxa_csp_oauth_url != ""){
csp.directives.connectSrc.push(config.fxa_csp_oauth_url)
}
if(config.fxa_csp_content_url != "" ){
csp.directives.connectSrc.push(config.fxa_csp_content_url)
}
if(config.fxa_csp_profile_url != "" ){
csp.directives.connectSrc.push(config.fxa_csp_profile_url)
}
if(config.fxa_csp_profileimage_url != ""){
csp.directives.imgSrc.push(config.fxa_csp_profileimage_url)
}
app.use(
helmet.contentSecurityPolicy(csp)
);
}
app.use(function(req, res, next) {
res.set('Pragma', 'no-cache');
res.set(