github/hedgedoc
1
0
Fork 0
mirror of https://github.com/hedgedoc/hedgedoc.git synced 2024-11-25 11:16:31 -05:00
Code Issues Projects Releases Packages Wiki Activity

CSP: Upgrade insecure requests if possible

Browse source 
Config option; default is to only upgrade if usessl
This commit is contained in:
Literallie 2017-10-18 17:45:57 +02:00
parent ba183ce654
commit 5d2d3ec875
No known key found for this signature in database
GPG key ID: 7BE463C902ED152C
2 changed files with 8 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
app.js
View file

@ -126,6 +126,11 @@ if (config.csp.enable) {
directives[propertyName] = directive;
}
}
if(config.csp.upgradeInsecureRequests === 'auto') {
directives.upgradeInsecureRequests = config.usessl === 'true'
} else {
directives.upgradeInsecureRequests = config.csp.upgradeInsecureRequests === 'true'
}
app.use(helmet.contentSecurityPolicy({
directives: directives
}))

5
lib/config/default.js
View file

@ -20,8 +20,9 @@ module.exports = {
defaultSrc: ["'self'"],
scriptSrc: ["'self'"],
styleSrc: ["'self'", "'unsafe-inline'"],
fontSrc: ["'self'"]
}
fontSrc: ["'self'"],
},
upgradeInsecureRequests: 'auto'
},
protocolusessl: false,
usecdn: true,