extern/2FAuth
1
0
Fork 0
mirror of https://github.com/Bubka/2FAuth.git synced 2025-01-02 20:39:20 +01:00
Code Issues Packages Projects Releases Wiki Activity

Fix & Enable back CSP - Fixes #417

Browse Source
This commit is contained in:
Bubka 2024-11-19 12:47:37 +01:00
parent c6d0bcb2ab
commit e349c1057b
5 changed files with 21 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
.env.example
View File

@ -279,7 +279,7 @@ PROXY_FOR_OUTGOING_REQUESTS=null
# This is mainly used as a defense against cross-site scripting (XSS) attacks, in which
# an attacker is able to inject malicious code into the web app
CONTENT_SECURITY_POLICY=false
CONTENT_SECURITY_POLICY=true
# Leave the following configuration vars as is.

2
Dockerfile vendored
View File

@ -242,7 +242,7 @@ ENV \
# CSP helps to prevent or minimize the risk of certain types of security threats.
# This is mainly used as a defense against cross-site scripting (XSS) attacks, in which
# an attacker is able to inject malicious code into the web app
CONTENT_SECURITY_POLICY=false \
CONTENT_SECURITY_POLICY=true \
# Leave the following configuration vars as is.
# Unless you like to tinker and know what you're doing.
BROADCAST_DRIVER=log \

23
app/Http/Middleware/AddContentSecurityPolicyHeaders.php
View File

@ -16,13 +16,24 @@ class AddContentSecurityPolicyHeaders
*/
public function handle(Request $request, Closure $next) : Response
{
// if (config('2fauth.config.contentSecurityPolicy')) {
// Vite::useCspNonce();
if (config('2fauth.config.contentSecurityPolicy')) {
Vite::useCspNonce();
// return $next($request)->withHeaders([
// 'Content-Security-Policy' => "script-src 'nonce-" . Vite::cspNonce() . "';style-src 'self' 'unsafe-inline';connect-src 'self';img-src 'self' data:;object-src 'none';",
// ]);
// }
$assetUrl = config('app.asset_url') != config('app.url') ? config('app.asset_url') : '';
$directives['script-src'] = "script-src 'nonce-" . Vite::cspNonce() . "' " . $assetUrl . ";";
$directives['script-src-elem'] = "script-src-elem 'nonce-" . Vite::cspNonce() . "' " . $assetUrl . " 'strict-dynamic';";
$directives['style-src'] = "style-src 'self' " . $assetUrl . " 'unsafe-inline';";
$directives['connect-src'] = "connect-src 'self';";
$directives['img-src'] = "img-src 'self' data: " . $assetUrl . ";";
$directives['object-src'] = "object-src 'none';";
$csp = implode(' ', $directives);
return $next($request)->withHeaders([
'Content-Security-Policy' => $csp,
]);
}
return $next($request);
}

2
config/2fauth.php
View File

@ -31,7 +31,7 @@
'proxyLogoutUrl' => env('PROXY_LOGOUT_URL', null),
'appSubdirectory' => env('APP_SUBDIRECTORY', ''),
'authLogRetentionTime' => envUnlessEmpty('AUTHENTICATION_LOG_RETENTION', 365),
'contentSecurityPolicy' => envUnlessEmpty('CONTENT_SECURITY_POLICY', false),
'contentSecurityPolicy' => envUnlessEmpty('CONTENT_SECURITY_POLICY', true),
],
/*

2
resources/views/landing.blade.php vendored
View File

@ -15,7 +15,7 @@
<link rel="icon" type="image/png" href="{{ asset('favicon.png') }}" />
<link rel="apple-touch-icon" href="{{ asset('favicon_lg.png') }}" />
<link rel="apple-touch-icon-precomposed" href="{{ asset('favicon_lg.png') }}" />
<link rel="manifest" href="{{ asset('manifest.json') }}">
<link rel="manifest" href="manifest.json">
</head>
<body>