28 lines
1.4 KiB
TypeScript
28 lines
1.4 KiB
TypeScript
export function securityHeaders(production: boolean) {
|
|
const ads = "https://*.googlesyndication.com https://*.doubleclick.net https://*.googleadservices.com https://*.googletagservices.com https://www.google.com";
|
|
const policy = [
|
|
"default-src 'self'",
|
|
`script-src 'self' 'unsafe-inline' ${production ? "" : "'unsafe-eval'"} https://challenges.cloudflare.com ${ads}`,
|
|
"style-src 'self' 'unsafe-inline'",
|
|
`img-src 'self' data: blob: https://buzz-cdn.astrxl.dev ${ads}`,
|
|
"font-src 'self' data:",
|
|
`connect-src 'self' https://buzz-cdn.astrxl.dev https://challenges.cloudflare.com ${ads}${production ? "" : " ws: wss:"}`,
|
|
`frame-src https://challenges.cloudflare.com https://www.youtube-nocookie.com ${ads}`,
|
|
"media-src 'self' blob:",
|
|
"worker-src 'self' blob:",
|
|
"object-src 'none'",
|
|
"base-uri 'self'",
|
|
"form-action 'self'",
|
|
"frame-ancestors 'none'",
|
|
...(production ? ["upgrade-insecure-requests"] : []),
|
|
].join("; ");
|
|
return [
|
|
{ key: "Content-Security-Policy", value: policy },
|
|
{ key: "X-Content-Type-Options", value: "nosniff" },
|
|
{ key: "X-Frame-Options", value: "DENY" },
|
|
{ key: "Referrer-Policy", value: "strict-origin-when-cross-origin" },
|
|
{ key: "Permissions-Policy", value: "camera=(), microphone=(), geolocation=(), payment=(), usb=()" },
|
|
...(production ? [{ key: "Strict-Transport-Security", value: "max-age=31536000" }] : []),
|
|
];
|
|
}
|