sevenhill/QSfera
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: bump upstream sec middleware

Browse Source
This commit is contained in:
Michael Barz
2024-06-10 17:20:38 +02:00
parent 817b6e3e96
commit ccb8228edd
5 changed files with 53 additions and 35 deletions
Download Patch File Download Diff File Expand all files Collapse all files
vendor/github.com/unrolled/secure/secure.go
Generated Vendored
+35 -18
View File
@@ -11,22 +11,23 @@ import (
type secureCtxKey string
const (
stsHeader = "Strict-Transport-Security"
stsSubdomainString = "; includeSubDomains"
stsPreloadString = "; preload"
frameOptionsHeader = "X-Frame-Options"
frameOptionsValue = "DENY"
contentTypeHeader = "X-Content-Type-Options"
contentTypeValue = "nosniff"
xssProtectionHeader = "X-XSS-Protection"
xssProtectionValue = "1; mode=block"
cspHeader = "Content-Security-Policy"
cspReportOnlyHeader = "Content-Security-Policy-Report-Only"
hpkpHeader = "Public-Key-Pins"
referrerPolicyHeader = "Referrer-Policy"
featurePolicyHeader = "Feature-Policy"
permissionsPolicyHeader = "Permissions-Policy"
coopHeader = "Cross-Origin-Opener-Policy"
stsHeader = "Strict-Transport-Security"
stsSubdomainString = "; includeSubDomains"
stsPreloadString = "; preload"
frameOptionsHeader = "X-Frame-Options"
frameOptionsValue = "DENY"
contentTypeHeader = "X-Content-Type-Options"
contentTypeValue = "nosniff"
xssProtectionHeader = "X-XSS-Protection"
xssProtectionValue = "1; mode=block"
cspHeader = "Content-Security-Policy"
cspReportOnlyHeader = "Content-Security-Policy-Report-Only"
referrerPolicyHeader = "Referrer-Policy"
featurePolicyHeader = "Feature-Policy"
permissionsPolicyHeader = "Permissions-Policy"
coopHeader = "Cross-Origin-Opener-Policy"
robotTagHeader = "X-Robots-Tag"
permittedCrossDomainPoliciesHeader = "X-Permitted-Cross-Domain-Policies"
ctxDefaultSecureHeaderKey = secureCtxKey("SecureResponseHeader")
cspNonceSize = 16
@@ -65,7 +66,7 @@ type Options struct {
SSLRedirect bool
// If SSLForceHost is true and SSLHost is set, requests will be forced to use SSLHost even the ones that are already using SSL. Default is false.
SSLForceHost bool
// If SSLTemporaryRedirect is true, the a 302 will be used while redirecting. Default is false (301).
// If SSLTemporaryRedirect is true, a 302 will be used while redirecting. Default is false (301).
SSLTemporaryRedirect bool
// If STSIncludeSubdomains is set to true, the `includeSubdomains` will be appended to the Strict-Transport-Security header. Default is false.
STSIncludeSubdomains bool
@@ -110,9 +111,15 @@ type Options struct {
STSSeconds int64
// SecureContextKey allows a custom key to be specified for context storage.
SecureContextKey string
// PermittedCrossDomainPolicies allows to set the X-Permitted-Cross-Domain-Policies header
// Reference https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers
PermittedCrossDomainPolicies string
// RobotTag allows to set the X-Robot-Tag header
// Reference https://developers.google.com/search/docs/crawling-indexing/robots-meta-tag
RobotTag string
}
// Secure is a middleware that helps setup a few basic security features. A single secure.Options struct can be
// Secure is a middleware that helps set up a few basic security features. A single secure.Options struct can be
// provided to configure which features should be enabled, and the ability to override a few of the default values.
type Secure struct {
// Customize Secure with an Options struct.
@@ -466,6 +473,16 @@ func (s *Secure) processRequest(w http.ResponseWriter, r *http.Request) (http.He
responseHeader.Set(coopHeader, s.opt.CrossOriginOpenerPolicy)
}
// X-Permitted-Cross-Domain-Policies
if len(s.opt.PermittedCrossDomainPolicies) > 0 {
responseHeader.Set(permittedCrossDomainPoliciesHeader, s.opt.PermittedCrossDomainPolicies)
}
// X-Robots-Tag
if len(s.opt.RobotTag) > 0 {
responseHeader.Set(robotTagHeader, s.opt.RobotTag)
}
return responseHeader, r, nil
}