mirror of
https://github.com/opencloud-eu/opencloud.git
synced 2026-01-20 03:52:32 -05:00
bdbba929d0
* feat: add CSP and other security related headers in the oCIS proxy service * fix: consolidate security related headers - drop middleware.Secure * fix: use github.com/DeepDiver1975/secure * fix: acceptance tests * feat: support env var replacements in csp.yaml
41 lines
1.3 KiB
Go
41 lines
1.3 KiB
Go
package middleware
|
|
|
|
import (
|
|
"net/http"
|
|
"strings"
|
|
"time"
|
|
|
|
"github.com/owncloud/ocis/v2/ocis-pkg/cors"
|
|
|
|
chicors "github.com/go-chi/cors"
|
|
)
|
|
|
|
// NoCache writes required cache headers to all requests.
|
|
func NoCache(next http.Handler) http.Handler {
|
|
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
w.Header().Set("Cache-Control", "no-cache, no-store, max-age=0, must-revalidate, value")
|
|
w.Header().Set("Expires", "Thu, 01 Jan 1970 00:00:00 GMT")
|
|
w.Header().Set("Last-Modified", time.Now().UTC().Format(http.TimeFormat))
|
|
|
|
next.ServeHTTP(w, r)
|
|
})
|
|
}
|
|
|
|
// Cors writes required cors headers to all requests.
|
|
func Cors(opts ...cors.Option) func(http.Handler) http.Handler {
|
|
options := cors.NewOptions(opts...)
|
|
logger := options.Logger
|
|
logger.Debug().
|
|
Str("allowed_origins", strings.Join(options.AllowedOrigins, ", ")).
|
|
Str("allowed_methods", strings.Join(options.AllowedMethods, ", ")).
|
|
Str("allowed_headers", strings.Join(options.AllowedHeaders, ", ")).
|
|
Bool("allow_credentials", options.AllowCredentials).
|
|
Msg("setup cors middleware")
|
|
return chicors.Handler(chicors.Options{
|
|
AllowedOrigins: options.AllowedOrigins,
|
|
AllowedMethods: options.AllowedMethods,
|
|
AllowedHeaders: options.AllowedHeaders,
|
|
AllowCredentials: options.AllowCredentials,
|
|
})
|
|
}
|