feat: add CSP and other security related headers in the oCIS proxy service (#8777)

* feat: add CSP and other security related headers in the oCIS proxy service

* fix: consolidate security related headers - drop middleware.Secure

* fix: use github.com/DeepDiver1975/secure

* fix: acceptance tests

* feat: support env var replacements in csp.yaml

ocis-pkg/middleware/header.go

@@ -38,22 +38,3 @@ func Cors(opts ...cors.Option) func(http.Handler) http.Handler {
 		AllowCredentials: options.AllowCredentials,
 	})
 }
-
-// Secure writes required access headers to all requests.
-func Secure(next http.Handler) http.Handler {
-	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		// Indicates whether the browser is allowed to render this page in a <frame>, <iframe>, <embed> or <object>.
-		w.Header().Set("X-Frame-Options", "DENY")
-		// Does basically the same as X-Frame-Options.
-		w.Header().Set("Content-Security-Policy", "frame-ancestors 'none'")
-		// This header inidicates that MIME types advertised in the Content-Type headers should not be changed and be followed.
-		w.Header().Set("X-Content-Type-Options", "nosniff")
-
-		if r.TLS != nil {
-			// Tell browsers that the website should only be accessed  using HTTPS.
-			w.Header().Set("Strict-Transport-Security", "max-age=31536000")
-		}
-
-		next.ServeHTTP(w, r)
-	})
-}

ocis-pkg/service/debug/service.go

@@ -68,7 +68,6 @@ func NewService(opts ...Option) *http.Server {
 				cors.AllowedHeaders(dopts.CorsAllowedHeaders),
 				cors.AllowCredentials(dopts.CorsAllowCredentials),
 			),
-			middleware.Secure,
 			middleware.Version(
 				dopts.Name,
 				dopts.Version,