blitzwing/cryptpad
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix headers added by node for the recommended config

Browse source
This commit is contained in:
yflory 2023-09-05 13:01:41 +02:00
parent 920c307608
commit fde6f15270
1 changed files with 4 additions and 12 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

16
lib/http-worker.js
View file

@ -127,23 +127,15 @@ var getHeaders = function (Env, type) {
csp = Default.contentSecurity(Env);
}
headers['Content-Security-Policy'] = csp;
if (Env.NO_SANDBOX) { // handles correct configuration for local development
// https://stackoverflow.com/questions/11531121/add-duplicate-http-response-headers-in-nodejs
headers["Cross-Origin-Resource-Policy"] = 'cross-origin';
headers["Cross-Origin-Embedder-Policy"] = 'require-corp';
}
headers["Cross-Origin-Resource-Policy"] = 'cross-origin';
headers["Cross-Origin-Embedder-Policy"] = 'require-corp';
cacheHeaders(Env, key, headers);
// Don't set CSP headers on /api/ endpoints
// because they aren't necessary and they cause problems
// when duplicated by NGINX in production environments
if (type === 'api') {
cacheHeaders(Env, key, headers);
return headers;
}
if (type === 'api') { delete headers['Content-Security-Policy']; }
headers["Cross-Origin-Resource-Policy"] = 'cross-origin';
cacheHeaders(Env, key, headers);
return headers;
};