Download this file
| 1 | package home |
| 2 | |
| 3 | import ( |
| 4 | "sort" |
| 5 | "strings" |
| 6 | ) |
| 7 | |
| 8 | // SecurityPolicy preserves framework defaults and names only registered form |
| 9 | // destinations. The credential origin renders no account-authored markup. |
| 10 | func (a *App) SecurityPolicy() string { |
| 11 | origins := map[string]bool{a.origins.Directory: true} |
| 12 | if a.runtime != nil { |
| 13 | for _, origin := range a.runtime.consumers { |
| 14 | origins[origin] = true |
| 15 | } |
| 16 | // form-action governs a form's redirects too, so the directory's |
| 17 | // sign-out, which 307s its POST on to the credential origin, is |
| 18 | // blocked in the browser without this. See signoutPath. |
| 19 | if a.runtime.role == "directory" { |
| 20 | origins[a.origins.Credential] = true |
| 21 | } |
| 22 | } |
| 23 | list := make([]string, 0, len(origins)) |
| 24 | for origin := range origins { |
| 25 | list = append(list, origin) |
| 26 | } |
| 27 | sort.Strings(list) |
| 28 | return "default-src 'self'; style-src 'self' 'unsafe-inline'; " + |
| 29 | "img-src 'self' data:; frame-ancestors 'none'; base-uri 'self'; form-action 'self' " + strings.Join(list, " ") |
| 30 | } |
| 31 | |
amadan