From 6e20f08d4e7d1802c1fd20d15091dd2f47d7478f Mon Sep 17 00:00:00 2001 From: "Collin M. Barrett" Date: Sat, 23 Jan 2021 14:57:29 -0600 Subject: [PATCH] =?UTF-8?q?fix(reverse-proxy):=20=F0=9F=90=9B=20restor=20C?= =?UTF-8?q?ORS=20config=20fixing=20web=20mime=20type=20CSP?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- reverse-proxy/conf.d.dev/default.conf | 2 +- reverse-proxy/conf.d/default.conf | 2 +- reverse-proxy/loc-includes/cors.conf | 54 +++++++++++++-------------- web/public/index.html | 3 ++ 4 files changed, 32 insertions(+), 29 deletions(-) diff --git a/reverse-proxy/conf.d.dev/default.conf b/reverse-proxy/conf.d.dev/default.conf index 0eb30ad44..22421dd50 100644 --- a/reverse-proxy/conf.d.dev/default.conf +++ b/reverse-proxy/conf.d.dev/default.conf @@ -1,7 +1,7 @@ server { listen 80 default_server; include svr-includes/*; - add_header Content-Security-Policy "default-src 'none'; connect-src 'self'; img-src 'self' validator.swagger.io data:; manifest-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; base-uri 'none'; form-action 'none'; frame-ancestors 'none';" always; + add_header Content-Security-Policy "default-src 'none'; connect-src 'self'; img-src 'self' validator.swagger.io data:; manifest-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; base-uri 'self'; form-action 'none'; frame-ancestors 'none';" always; location ^~ /api/archival/ { rewrite ^/api/archival/(.*)$ /$1 break; diff --git a/reverse-proxy/conf.d/default.conf b/reverse-proxy/conf.d/default.conf index bf5120218..913027dc9 100644 --- a/reverse-proxy/conf.d/default.conf +++ b/reverse-proxy/conf.d/default.conf @@ -4,7 +4,7 @@ server { include svr-includes/*; ssl_certificate /etc/nginx/cert/filterlists_cert.pem; ssl_certificate_key /etc/nginx/cert/filterlists_key.pem; - add_header Content-Security-Policy "default-src 'none'; connect-src 'self'; img-src 'self' validator.swagger.io data:; manifest-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; base-uri 'none'; form-action 'none'; frame-ancestors 'none';" always; + add_header Content-Security-Policy "default-src 'none'; connect-src 'self'; img-src 'self' validator.swagger.io data:; manifest-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; base-uri 'self'; form-action 'none'; frame-ancestors 'none';" always; location ^~ /api/archival/ { rewrite ^/api/archival/(.*)$ /$1 break; diff --git a/reverse-proxy/loc-includes/cors.conf b/reverse-proxy/loc-includes/cors.conf index 06f77f8ac..84f1c78c8 100644 --- a/reverse-proxy/loc-includes/cors.conf +++ b/reverse-proxy/loc-includes/cors.conf @@ -2,30 +2,30 @@ # # Wide-open CORS config for nginx # -# if ($request_method = 'OPTIONS') { -# add_header 'Access-Control-Allow-Origin' '*'; -# add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS'; -# # -# # Custom headers and headers various browsers *should* be OK with but aren't -# # -# add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range'; -# # -# # Tell client that this pre-flight info is valid for 20 days -# # -# add_header 'Access-Control-Max-Age' 1728000; -# add_header 'Content-Type' 'text/plain; charset=utf-8'; -# add_header 'Content-Length' 0; -# return 204; -# } -# if ($request_method = 'POST') { -# add_header 'Access-Control-Allow-Origin' '*'; -# add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS'; -# add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range'; -# add_header 'Access-Control-Expose-Headers' 'Content-Length,Content-Range'; -# } -# if ($request_method = 'GET') { -# add_header 'Access-Control-Allow-Origin' '*'; -# add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS'; -# add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range'; -# add_header 'Access-Control-Expose-Headers' 'Content-Length,Content-Range'; -# } \ No newline at end of file +if ($request_method = 'OPTIONS') { + add_header 'Access-Control-Allow-Origin' '*'; + add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS'; + # + # Custom headers and headers various browsers *should* be OK with but aren't + # + add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range'; + # + # Tell client that this pre-flight info is valid for 20 days + # + add_header 'Access-Control-Max-Age' 1728000; + add_header 'Content-Type' 'text/plain; charset=utf-8'; + add_header 'Content-Length' 0; + return 204; +} +if ($request_method = 'POST') { + add_header 'Access-Control-Allow-Origin' '*'; + add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS'; + add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range'; + add_header 'Access-Control-Expose-Headers' 'Content-Length,Content-Range'; +} +if ($request_method = 'GET') { + add_header 'Access-Control-Allow-Origin' '*'; + add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS'; + add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range'; + add_header 'Access-Control-Expose-Headers' 'Content-Length,Content-Range'; +} \ No newline at end of file diff --git a/web/public/index.html b/web/public/index.html index 7b04db695..e72124aa2 100644 --- a/web/public/index.html +++ b/web/public/index.html @@ -37,6 +37,9 @@ href="https://filterlists.com/icon_filterlists.png" /> + + +