first commit

api/app/middleware/security_headers_middleware.ts

@@ -0,0 +1,39 @@
+import app from '@adonisjs/core/services/app'
+import type { HttpContext } from '@adonisjs/core/http'
+import type { NextFn } from '@adonisjs/core/types/http'
+
+/**
+ * Only same-origin resources. Angular puts the component styles in
+ * <style> tags, hence "unsafe-inline" for styles (not for scripts).
+ */
+const CONTENT_SECURITY_POLICY = [
+  "default-src 'self'",
+  "script-src 'self'",
+  "style-src 'self' 'unsafe-inline'",
+  "img-src 'self' data:",
+  "font-src 'self'",
+  "connect-src 'self'",
+  "object-src 'none'",
+  "base-uri 'self'",
+  "form-action 'self'",
+  "frame-ancestors 'none'",
+].join('; ')
+
+/**
+ * Sets the security headers on every response, including the static
+ * files served before the router (which shield does not cover).
+ */
+export default class SecurityHeadersMiddleware {
+  handle({ response }: HttpContext, next: NextFn) {
+    response.header('Content-Security-Policy', CONTENT_SECURITY_POLICY)
+    response.header('X-Frame-Options', 'DENY')
+    response.header('X-Content-Type-Options', 'nosniff')
+    response.header('Referrer-Policy', 'no-referrer')
+    response.header('Permissions-Policy', 'camera=(), microphone=(), geolocation=()')
+    response.header('Cross-Origin-Opener-Policy', 'same-origin')
+    if (app.inProduction) {
+      response.header('Strict-Transport-Security', 'max-age=15552000')
+    }
+    return next()
+  }
+}