beenull/libreddit
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Specify default headers for security

Browse source
This commit is contained in:
spikecodes 2021-01-28 21:53:10 -08:00
parent 30c33d91e1
commit f55ea5a353
3 changed files with 10 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
src/main.rs
View file

@ -21,12 +21,14 @@ async fn style() -> HttpResponse {
async fn robots() -> HttpResponse {
HttpResponse::Ok()
.content_type("text/plain")
.header("Cache-Control", "public, max-age=1209600, s-maxage=86400")
.body("User-agent: *\nAllow: /")
}
async fn favicon() -> HttpResponse {
HttpResponse::Ok()
.content_type("image/x-icon")
.header("Cache-Control", "public, max-age=1209600, s-maxage=86400")
.body(include_bytes!("../static/favicon.ico").as_ref())
}
@ -66,6 +68,12 @@ async fn main() -> std::io::Result<()> {
})
// Append trailing slash and remove double slashes
.wrap(middleware::NormalizePath::default())
// Apply default headers for security
.wrap(middleware::DefaultHeaders::new()
.header("Referrer-Policy", "no-referrer")
.header("X-Content-Type-Options", "nosniff")
.header("X-Frame-Options", "DENY")
.header("Content-Security-Policy", "default-src 'self'; style-src 'self' 'unsafe-inline'; base-uri 'none'; img-src 'self' data:; form-action 'self'; frame-ancestors: 'none';"))
// Default service in case no routes match
.default_service(web::get().to(|| utils::error("Nothing here".to_string())))
// Read static files

2
templates/base.html
View file

@ -4,7 +4,7 @@
{% block head %}
<title>{% block title %}Libreddit{% endblock %}</title>
<meta http-equiv="Referrer-Policy" content="no-referrer">
<meta http-equiv="Content-Security-Policy" content="default-src 'self'; style-src 'self' 'unsafe-inline'; base-uri 'none'; img-src 'self' data:; form-action 'self';">
<meta http-equiv="Content-Security-Policy" content="default-src 'self'; style-src 'self' 'unsafe-inline'; base-uri 'none'; img-src 'self' data:; form-action 'self'; frame-ancestors: 'none';">
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
<meta name="description" content="View on Libreddit, an alternative private front-end to Reddit.">
<meta name="viewport" content="width=device-width, initial-scale=1.0">

2
templates/post.html
View file

@ -73,7 +73,7 @@
</svg>
</a>
{% else if post.post_type == "video" || post.post_type == "gif" %}
<video class="post_media" src="{{ post.media.url }}" type="video/mp4" controls autoplay loop playsinline></video>
<video class="post_media" src="{{ post.media.url }}" controls autoplay loop></video>
{% else if post.post_type == "link" %}
<a id="post_url" href="{{ post.media.url }}">{{ post.media.url }}</a>
{% endif %}