medlogic
/
olivetin
3
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

chore: Use a constant for the default CSP

This commit is contained in:
jamesread 2026-03-09 10:00:47 +00:00
parent b298a6bd8c
commit b33aded230
3 changed files with 7 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
service/internal/config/config.go
View File

@ -281,7 +281,7 @@ func DefaultConfigWithBasePort(basePort int) *Config {
config.Prometheus.Enabled = false config.Prometheus.Enabled = false
config.Prometheus.DefaultGoMetrics = false config.Prometheus.DefaultGoMetrics = false
config.Security.HeaderContentSecurityPolicy = true config.Security.HeaderContentSecurityPolicy = true
config.Security.ContentSecurityPolicy = "default-src 'self'; script-src 'self' 'unsafe-inline' https:; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; connect-src 'self' https:; frame-ancestors 'none'; base-uri 'self'" config.Security.ContentSecurityPolicy = ContentSecurityPolicyDefault
config.Security.HeaderXContentTypeOptions = true config.Security.HeaderXContentTypeOptions = true
config.Security.HeaderXFrameOptions = true config.Security.HeaderXFrameOptions = true
config.Security.XFrameOptions = "DENY" config.Security.XFrameOptions = "DENY"

5
service/internal/config/constants.go Normal file
View File

@ -0,0 +1,5 @@
package config
// ContentSecurityPolicyDefault is the default Content-Security-Policy header value
// when security headers are enabled and no custom policy is set.
const ContentSecurityPolicyDefault = "default-src 'self'; script-src 'self' 'unsafe-inline' https:; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; connect-src 'self' https:; frame-ancestors 'none'; base-uri 'self'"

2
service/internal/config/sanitize.go
View File

@ -194,7 +194,7 @@ func (cfg *Config) sanitizeSecurityHeadersCSP() {
if !cfg.Security.HeaderContentSecurityPolicy || cfg.Security.ContentSecurityPolicy != "" { if !cfg.Security.HeaderContentSecurityPolicy || cfg.Security.ContentSecurityPolicy != "" {
return return
} }
cfg.Security.ContentSecurityPolicy = "default-src 'self'; script-src 'self' 'unsafe-inline' https:; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; connect-src 'self' https:; frame-ancestors 'none'; base-uri 'self'" cfg.Security.ContentSecurityPolicy = ContentSecurityPolicyDefault
} }
func (cfg *Config) sanitizeSecurityHeadersXFrameOptions() { func (cfg *Config) sanitizeSecurityHeadersXFrameOptions() {