Infrastructure/logto
0
Fork 0
mirror of https://github.com/logto-io/logto.git synced 2025-02-17 22:04:19 -05:00
Code Issues Activity

refactor(core): remove the reportOnly flag (#3849)

Browse source 
* refactor(core): remove the reportOnly flag

remove all the reportOnly flag of the CSP security headers. Bring up strict policy check

* chore: add changeset

add changeset
This commit is contained in:
simeng-li 2023-05-17 14:00:01 +08:00 • committed by GitHub
parent 1cd854a63c
commit ac65c8de4a
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
3 changed files with 8 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
.changeset/cool-oranges-cheer.md Normal file
View file

@ -0,0 +1,8 @@
---
"@logto/cloud": patch
"@logto/core": patch
---
### Enable strict CSP policy check header
This change removes the report only flag from CSP security header settings, which will enables the strict CSP policy check for all requests.

2
packages/cloud/src/middleware/with-security-headers.ts
View file

@ -86,8 +86,6 @@ export default function withSecurityHeaders<InputContext extends RequestContext>
frameguard: false,
contentSecurityPolicy: {
useDefaults: true,
// Temporary set to report only to avoid breaking the app
reportOnly: true,
directives: {
'upgrade-insecure-requests': null,
imgSrc: ["'self'", 'data:', 'https:'],

4
packages/core/src/middleware/koa-security-headers.ts
View file

@ -76,8 +76,6 @@ export default function koaSecurityHeaders<StateT, ContextT, ResponseBodyT>(
},
contentSecurityPolicy: {
useDefaults: true,
// Temporary set to report only to avoid breaking the app
reportOnly: true,
directives: {
'upgrade-insecure-requests': null,
imgSrc: ["'self'", 'data:', 'https:'],
@ -103,8 +101,6 @@ export default function koaSecurityHeaders<StateT, ContextT, ResponseBodyT>(
frameguard: false,
contentSecurityPolicy: {
useDefaults: true,
// Temporary set to report only to avoid breaking the app
reportOnly: true,
directives: {
'upgrade-insecure-requests': null,
imgSrc: ["'self'", 'data:', 'https:'],