chris/calque
1
0
Fork 0
Code Issues 13 Pull requests Projects Releases Packages Wiki Activity Actions

added CSP

Browse source
This commit is contained in:
Chris Kruining 2024-11-07 09:49:21 +01:00
parent dc30ebb35e
commit 3a79fd4488
No known key found for this signature in database
GPG key ID: EB894A3560CCCAD2
2 changed files with 39 additions and 17 deletions
Download patch file Download diff file Expand all files Collapse all files

3
app.config.ts
View file

@ -3,6 +3,9 @@ import { VitePWA } from 'vite-plugin-pwa'
export default defineConfig({ export default defineConfig({
vite: { vite: {
html: {
cspNonce: 'KAAS_IS_AWESOME',
},
plugins: [ plugins: [
VitePWA({ VitePWA({
mode: 'development', mode: 'development',

29
src/entry-server.tsx
View file

@ -4,13 +4,16 @@ import { installIntoGlobal } from "iterator-helpers-polyfill";
installIntoGlobal(); installIntoGlobal();
export default createHandler(() => ( export default createHandler(({ nonce }) => {
return (
<StartServer <StartServer
document={({ assets, children, scripts }) => ( document={({ assets, children, scripts }) => {
return (
<html lang="en"> <html lang="en">
<head> <head>
<meta charset="utf-8" /> <meta charset="utf-8" />
<meta name="viewport" content="width=device-width, initial-scale=1, viewport-fit=cover" /> <meta name="viewport" content="width=device-width, initial-scale=1, viewport-fit=cover" />
<meta property="csp-nonce" nonce={nonce} />
{assets} {assets}
</head> </head>
<body> <body>
@ -18,6 +21,22 @@ export default createHandler(() => (
{scripts} {scripts}
</body> </body>
</html> </html>
)} );
/> }} />
)); );
}, event => {
const nonce = crypto.randomUUID();
const base = `'self' 'nonce-${nonce}'`;
const policies = {
default: base,
connect: `${base} ws://localhost:*`,
style: `'self' data: https://fonts.googleapis.com 'unsafe-inline'`,
// style: `${base} data: https://fonts.googleapis.com`,
font: `${base} https://*.gstatic.com`,
} as const;
event.response.headers.append('Content-Security-Policy', Object.entries(policies).map(([p, v]) => `${p}-src ${v}`).join('; '))
return { nonce };
});