29 lines
1.5 KiB
TypeScript
29 lines
1.5 KiB
TypeScript
export function securityHeaders(production: boolean, emojiImageCdn: string) {
|
|
const commentStorageOrigin = process.env.S3_PUBLIC_URL ? new URL(process.env.S3_PUBLIC_URL).origin : "";
|
|
const cloudflareAnalytics = "https://static.cloudflareinsights.com";
|
|
const policy = [
|
|
"default-src 'self'",
|
|
`script-src 'self' 'unsafe-inline' ${production ? "" : "'unsafe-eval'"} https://challenges.cloudflare.com ${cloudflareAnalytics}`,
|
|
"style-src 'self' 'unsafe-inline'",
|
|
`img-src 'self' data: blob: https://buzz-cdn.astrxl.dev ${commentStorageOrigin} ${emojiImageCdn}`,
|
|
"font-src 'self' data:",
|
|
`connect-src 'self' https://buzz-cdn.astrxl.dev https://challenges.cloudflare.com${production ? "" : " ws: wss:"}`,
|
|
"frame-src https://challenges.cloudflare.com https://www.youtube-nocookie.com",
|
|
"media-src 'self' blob:",
|
|
"worker-src 'self' blob:",
|
|
"object-src 'none'",
|
|
"base-uri 'self'",
|
|
"form-action 'self'",
|
|
"frame-ancestors 'none'",
|
|
...(production ? ["upgrade-insecure-requests"] : []),
|
|
].join("; ");
|
|
return [
|
|
{ key: "Content-Security-Policy", value: policy },
|
|
{ key: "X-Content-Type-Options", value: "nosniff" },
|
|
{ key: "X-Frame-Options", value: "DENY" },
|
|
{ key: "Referrer-Policy", value: "strict-origin-when-cross-origin" },
|
|
{ key: "Permissions-Policy", value: "camera=(), microphone=(), geolocation=(), payment=(), usb=()" },
|
|
...(production ? [{ key: "Strict-Transport-Security", value: "max-age=31536000" }] : []),
|
|
];
|
|
}
|