mirror of https://github.com/gofiber/fiber.git
110 lines
2.9 KiB
Go
110 lines
2.9 KiB
Go
// 🚀 Fiber is an Express inspired web framework written in Go with 💖
|
|
// 📌 API Documentation: https://docs.gofiber.io/
|
|
// 📝 Github Repository: https://github.com/gofiber/fiber
|
|
|
|
package helmet
|
|
|
|
import (
|
|
"fmt"
|
|
|
|
"github.com/gofiber/fiber/v3"
|
|
)
|
|
|
|
// Config ...
|
|
type Config struct {
|
|
// Filter defines a function to skip middleware.
|
|
// Optional. Default: nil
|
|
Filter func(fiber.Ctx) bool
|
|
// XSSProtection
|
|
// Optional. Default value "1; mode=block".
|
|
XSSProtection string
|
|
// ContentTypeNosniff
|
|
// Optional. Default value "nosniff".
|
|
ContentTypeNosniff string
|
|
// XFrameOptions
|
|
// Optional. Default value "SAMEORIGIN".
|
|
// Possible values: "SAMEORIGIN", "DENY", "ALLOW-FROM uri"
|
|
XFrameOptions string
|
|
// HSTSMaxAge
|
|
// Optional. Default value 0.
|
|
HSTSMaxAge int
|
|
// HSTSExcludeSubdomains
|
|
// Optional. Default value false.
|
|
HSTSExcludeSubdomains bool
|
|
// ContentSecurityPolicy
|
|
// Optional. Default value "".
|
|
ContentSecurityPolicy string
|
|
// CSPReportOnly
|
|
// Optional. Default value false.
|
|
CSPReportOnly bool
|
|
// HSTSPreloadEnabled
|
|
// Optional. Default value false.
|
|
HSTSPreloadEnabled bool
|
|
// ReferrerPolicy
|
|
// Optional. Default value "".
|
|
ReferrerPolicy string
|
|
|
|
// Permissions-Policy
|
|
// Optional. Default value "".
|
|
PermissionPolicy string
|
|
}
|
|
|
|
// New ...
|
|
func New(config ...Config) fiber.Handler {
|
|
// Init config
|
|
var cfg Config
|
|
if len(config) > 0 {
|
|
cfg = config[0]
|
|
}
|
|
// Set config default values
|
|
if cfg.XSSProtection == "" {
|
|
cfg.XSSProtection = "1; mode=block"
|
|
}
|
|
if cfg.ContentTypeNosniff == "" {
|
|
cfg.ContentTypeNosniff = "nosniff"
|
|
}
|
|
if cfg.XFrameOptions == "" {
|
|
cfg.XFrameOptions = "SAMEORIGIN"
|
|
}
|
|
// Return middleware handler
|
|
return func(c fiber.Ctx) error {
|
|
// Filter request to skip middleware
|
|
if cfg.Filter != nil && cfg.Filter(c) {
|
|
return c.Next()
|
|
}
|
|
if cfg.XSSProtection != "" {
|
|
c.Set(fiber.HeaderXXSSProtection, cfg.XSSProtection)
|
|
}
|
|
if cfg.ContentTypeNosniff != "" {
|
|
c.Set(fiber.HeaderXContentTypeOptions, cfg.ContentTypeNosniff)
|
|
}
|
|
if cfg.XFrameOptions != "" {
|
|
c.Set(fiber.HeaderXFrameOptions, cfg.XFrameOptions)
|
|
}
|
|
if (c.Secure() || (c.Get(fiber.HeaderXForwardedProto) == "https")) && cfg.HSTSMaxAge != 0 {
|
|
subdomains := ""
|
|
if !cfg.HSTSExcludeSubdomains {
|
|
subdomains = "; includeSubdomains"
|
|
}
|
|
if cfg.HSTSPreloadEnabled {
|
|
subdomains = fmt.Sprintf("%s; preload", subdomains)
|
|
}
|
|
c.Set(fiber.HeaderStrictTransportSecurity, fmt.Sprintf("max-age=%d%s", cfg.HSTSMaxAge, subdomains))
|
|
}
|
|
if cfg.ContentSecurityPolicy != "" {
|
|
if cfg.CSPReportOnly {
|
|
c.Set(fiber.HeaderContentSecurityPolicyReportOnly, cfg.ContentSecurityPolicy)
|
|
} else {
|
|
c.Set(fiber.HeaderContentSecurityPolicy, cfg.ContentSecurityPolicy)
|
|
}
|
|
}
|
|
if cfg.ReferrerPolicy != "" {
|
|
c.Set(fiber.HeaderReferrerPolicy, cfg.ReferrerPolicy)
|
|
}
|
|
if cfg.PermissionPolicy != "" {
|
|
c.Set(fiber.HeaderPermissionsPolicy, cfg.PermissionPolicy)
|
|
}
|
|
return c.Next()
|
|
}
|
|
}
|