Infrastructure/logto
0
Fork 0
mirror of https://github.com/logto-io/logto.git synced 2024-12-30 20:33:54 -05:00
Code Issues Activity

chore(core): update code comments in security header middleware (#6634)

Browse source
This commit is contained in:
Charles Zhao 2024-09-25 16:18:52 +08:00 committed by GitHub
parent 0c43618f76
commit ea333b3dd9
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 7 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

15
packages/core/src/middleware/koa-security-headers.ts
View file

@ -89,9 +89,9 @@ export default function koaSecurityHeaders<StateT, ContextT, ResponseBodyT>(
// @ts-expect-error: helmet typings has lots of {A?: T, B?: never} | {A?: never, B?: T} options definitions. Optional settings type can not inferred correctly. // @ts-expect-error: helmet typings has lots of {A?: T, B?: never} | {A?: never, B?: T} options definitions. Optional settings type can not inferred correctly.
const experienceSecurityHeaderSettings: HelmetOptions = { const experienceSecurityHeaderSettings: HelmetOptions = {
...basicSecurityHeaderSettings, ...basicSecurityHeaderSettings,
// WARNING: high risk Need to allow self hosted terms of use page loaded in an iframe // WARNING (high risk): Need to allow self-hosted terms of use page loaded in an iframe
frameguard: false, frameguard: false,
// Alow loaded by console preview iframe // Allow being loaded by console preview iframe
crossOriginResourcePolicy: { crossOriginResourcePolicy: {
policy: 'cross-origin', policy: 'cross-origin',
}, },
@ -100,7 +100,6 @@ export default function koaSecurityHeaders<StateT, ContextT, ResponseBodyT>(
directives: { directives: {
'upgrade-insecure-requests': null, 'upgrade-insecure-requests': null,
imgSrc: ["'self'", 'data:', 'https:'], imgSrc: ["'self'", 'data:', 'https:'],
// Non-production environment allow "unsafe-eval" and "unsafe-inline" for debugging purpose
scriptSrc: [ scriptSrc: [
"'self'", "'self'",
"'unsafe-inline'", "'unsafe-inline'",
@ -108,12 +107,13 @@ export default function koaSecurityHeaders<StateT, ContextT, ResponseBodyT>(
// Some of our users may use the Cloudflare Web Analytics service. We need to allow it to // Some of our users may use the Cloudflare Web Analytics service. We need to allow it to
// load its scripts. // load its scripts.
'https://static.cloudflareinsights.com/', 'https://static.cloudflareinsights.com/',
// Allow "unsafe-eval" for debugging purpose in non-production environment
...conditionalArray(!isProduction && "'unsafe-eval'"), ...conditionalArray(!isProduction && "'unsafe-eval'"),
], ],
connectSrc: ["'self'", gsiOrigin, tenantEndpointOrigin, ...developmentOrigins], connectSrc: ["'self'", gsiOrigin, tenantEndpointOrigin, ...developmentOrigins],
// WARNING: high risk Need to allow self hosted terms of use page loaded in an iframe // WARNING (high risk): Need to allow self-hosted terms of use page loaded in an iframe
frameSrc: ["'self'", 'https:', gsiOrigin], frameSrc: ["'self'", 'https:', gsiOrigin],
// Alow loaded by console preview iframe // Allow being loaded by console preview iframe
frameAncestors: ["'self'", ...adminOrigins], frameAncestors: ["'self'", ...adminOrigins],
defaultSrc: ["'self'", gsiOrigin], defaultSrc: ["'self'", gsiOrigin],
}, },
@ -130,14 +130,13 @@ export default function koaSecurityHeaders<StateT, ContextT, ResponseBodyT>(
directives: { directives: {
'upgrade-insecure-requests': null, 'upgrade-insecure-requests': null,
imgSrc: ["'self'", 'data:', 'https:'], imgSrc: ["'self'", 'data:', 'https:'],
// Non-production environment allow "unsafe-eval" and "unsafe-inline" for debugging purpose // Allow "unsafe-eval" and "unsafe-inline" for debugging purpose in non-production environment
scriptSrc: [ scriptSrc: [
"'self'", "'self'",
...conditionalArray(!isProduction && ["'unsafe-eval'", "'unsafe-inline'"]), ...conditionalArray(!isProduction && ["'unsafe-eval'", "'unsafe-inline'"]),
...cdnSources, ...cdnSources,
], ],
connectSrc: ["'self'", logtoOrigin, ...adminOrigins, ...coreOrigins, ...developmentOrigins], connectSrc: ["'self'", logtoOrigin, ...adminOrigins, ...coreOrigins, ...developmentOrigins],
// Allow Main Flow origin loaded in preview iframe
frameSrc: ["'self'", ...adminOrigins, ...coreOrigins], frameSrc: ["'self'", ...adminOrigins, ...coreOrigins],
}, },
}, },
@ -164,7 +163,7 @@ export default function koaSecurityHeaders<StateT, ContextT, ResponseBodyT>(
return next(); return next();
} }
// Main flow UI // Experience
await helmetPromise(experienceSecurityHeaderSettings, req, res); await helmetPromise(experienceSecurityHeaderSettings, req, res);
return next(); return next();