mirror of https://github.com/gofiber/fiber.git
108 lines
2.8 KiB
Go
108 lines
2.8 KiB
Go
package middleware
|
|
|
|
import (
|
|
"fmt"
|
|
|
|
".."
|
|
)
|
|
|
|
// SecureConfig ...
|
|
type SecureConfig struct {
|
|
// Skip defines a function to skip middleware.
|
|
// Optional. Default: nil
|
|
Skip func(*fiber.Ctx) bool
|
|
// XSSProtection
|
|
// Optional. Default value "1; mode=block".
|
|
XSSProtection string
|
|
// ContentTypeNosniff
|
|
// Optional. Default value "nosniff".
|
|
ContentTypeNosniff string
|
|
// XFrameOptions
|
|
// Optional. Default value "SAMEORIGIN".
|
|
// Possible values: "SAMEORIGIN", "DENY", "ALLOW-FROM uri"
|
|
XFrameOptions string
|
|
// HSTSMaxAge
|
|
// Optional. Default value 0.
|
|
HSTSMaxAge int
|
|
// HSTSExcludeSubdomains
|
|
// Optional. Default value false.
|
|
HSTSExcludeSubdomains bool
|
|
// ContentSecurityPolicy
|
|
// Optional. Default value "".
|
|
ContentSecurityPolicy string
|
|
// CSPReportOnly
|
|
// Optional. Default value false.
|
|
CSPReportOnly bool
|
|
// HSTSPreloadEnabled
|
|
// Optional. Default value false.
|
|
HSTSPreloadEnabled bool
|
|
// ReferrerPolicy
|
|
// Optional. Default value "".
|
|
ReferrerPolicy string
|
|
}
|
|
|
|
// SecureConfigDefault is the defaul Secure middleware config.
|
|
var SecureConfigDefault = SecureConfig{
|
|
Skip: nil,
|
|
XSSProtection: "1; mode=block",
|
|
ContentTypeNosniff: "nosniff",
|
|
XFrameOptions: "SAMEORIGIN",
|
|
}
|
|
|
|
// Secure ...
|
|
func Secure(config ...SecureConfig) func(*fiber.Ctx) {
|
|
// Init config
|
|
var cfg SecureConfig
|
|
if len(config) > 0 {
|
|
cfg = config[0]
|
|
}
|
|
// Set config default values
|
|
if cfg.XSSProtection == "" {
|
|
cfg.XSSProtection = SecureConfigDefault.XSSProtection
|
|
}
|
|
if cfg.ContentTypeNosniff == "" {
|
|
cfg.ContentTypeNosniff = SecureConfigDefault.ContentTypeNosniff
|
|
}
|
|
if cfg.XFrameOptions == "" {
|
|
cfg.XFrameOptions = SecureConfigDefault.XFrameOptions
|
|
}
|
|
// Return middleware handler
|
|
return func(c *fiber.Ctx) {
|
|
// Skip middleware if Skip returns true
|
|
if cfg.Skip != nil && cfg.Skip(c) {
|
|
c.Next()
|
|
return
|
|
}
|
|
if cfg.XSSProtection != "" {
|
|
c.Set(fiber.HeaderXXSSProtection, cfg.XSSProtection)
|
|
}
|
|
if cfg.ContentTypeNosniff != "" {
|
|
c.Set(fiber.HeaderXContentTypeOptions, cfg.ContentTypeNosniff)
|
|
}
|
|
if cfg.XFrameOptions != "" {
|
|
c.Set(fiber.HeaderXFrameOptions, cfg.XFrameOptions)
|
|
}
|
|
if (c.Secure() || (c.Get(fiber.HeaderXForwardedProto) == "https")) && cfg.HSTSMaxAge != 0 {
|
|
subdomains := ""
|
|
if !cfg.HSTSExcludeSubdomains {
|
|
subdomains = "; includeSubdomains"
|
|
}
|
|
if cfg.HSTSPreloadEnabled {
|
|
subdomains = fmt.Sprintf("%s; preload", subdomains)
|
|
}
|
|
c.Set(fiber.HeaderStrictTransportSecurity, fmt.Sprintf("max-age=%d%s", cfg.HSTSMaxAge, subdomains))
|
|
}
|
|
if cfg.ContentSecurityPolicy != "" {
|
|
if cfg.CSPReportOnly {
|
|
c.Set(fiber.HeaderContentSecurityPolicyReportOnly, cfg.ContentSecurityPolicy)
|
|
} else {
|
|
c.Set(fiber.HeaderContentSecurityPolicy, cfg.ContentSecurityPolicy)
|
|
}
|
|
}
|
|
if cfg.ReferrerPolicy != "" {
|
|
c.Set(fiber.HeaderReferrerPolicy, cfg.ReferrerPolicy)
|
|
}
|
|
c.Next()
|
|
}
|
|
}
|