zenn
de767095ba
세션·로그인 제한, ZIP/업로드 스트리밍, CSP 최소 강제와 Report-Only, Playwright 격리 검증을 추가하고 미디어 목록을 reconcile 후 database 모드로 고정한다. Co-authored-by: Cursor <cursoragent@cursor.com>
71 lines
2.4 KiB
JavaScript
71 lines
2.4 KiB
JavaScript
import { getRequestURL, setResponseHeader } from 'h3'
|
|
|
|
const enforcedContentSecurityPolicy = [
|
|
"base-uri 'self'",
|
|
"object-src 'none'",
|
|
"frame-ancestors 'self'"
|
|
].join('; ')
|
|
|
|
const contentSecurityPolicyReportOnly = [
|
|
"default-src 'self' https: data: blob:",
|
|
"base-uri 'self'",
|
|
"object-src 'none'",
|
|
"frame-ancestors 'self'",
|
|
"script-src 'self' 'unsafe-inline' 'unsafe-eval' https:",
|
|
"style-src 'self' 'unsafe-inline' https:",
|
|
"img-src 'self' data: blob: https:",
|
|
"font-src 'self' data: https:",
|
|
"media-src 'self' blob: https:",
|
|
"frame-src https:",
|
|
"connect-src 'self' https: wss:",
|
|
"worker-src 'self' blob: https:",
|
|
"manifest-src 'self' https:",
|
|
'report-uri /api/csp-report',
|
|
'report-to csp-endpoint'
|
|
].join('; ')
|
|
|
|
/**
|
|
* 현재 요청과 같은 origin의 CSP 보고 URL을 안전하게 만든다.
|
|
* @param {import('h3').H3Event} event - 요청 이벤트
|
|
* @returns {string} CSP 보고 URL
|
|
*/
|
|
const getCspReportEndpoint = (event) => {
|
|
try {
|
|
const requestUrl = getRequestURL(event)
|
|
if (!['http:', 'https:'].includes(requestUrl.protocol)) {
|
|
return '/api/csp-report'
|
|
}
|
|
|
|
const endpoint = new URL('/api/csp-report', requestUrl.origin).toString()
|
|
return /["\\\r\n]/.test(endpoint) ? '/api/csp-report' : endpoint
|
|
} catch {
|
|
return '/api/csp-report'
|
|
}
|
|
}
|
|
|
|
/**
|
|
* 공통 보안 헤더와 호환성 관찰 CSP를 적용한다.
|
|
* @param {import('h3').H3Event} event - 요청 이벤트
|
|
* @param {{ enforceCsp?: boolean }} options - 강제 CSP 적용 옵션
|
|
* @returns {void}
|
|
*/
|
|
export const applySecurityHeaders = (event, options = {}) => {
|
|
const reportEndpoint = getCspReportEndpoint(event)
|
|
|
|
setResponseHeader(event, 'X-Content-Type-Options', 'nosniff')
|
|
setResponseHeader(event, 'Referrer-Policy', 'strict-origin-when-cross-origin')
|
|
setResponseHeader(event, 'X-Frame-Options', 'SAMEORIGIN')
|
|
setResponseHeader(event, 'Permissions-Policy', 'camera=(), microphone=(), geolocation=()')
|
|
setResponseHeader(event, 'Reporting-Endpoints', `csp-endpoint="${reportEndpoint}"`)
|
|
setResponseHeader(event, 'Report-To', JSON.stringify({
|
|
group: 'csp-endpoint',
|
|
max_age: 10886400,
|
|
endpoints: [{ url: reportEndpoint }]
|
|
}))
|
|
setResponseHeader(event, 'Content-Security-Policy-Report-Only', contentSecurityPolicyReportOnly)
|
|
|
|
if (options.enforceCsp !== false) {
|
|
setResponseHeader(event, 'Content-Security-Policy', enforcedContentSecurityPolicy)
|
|
}
|
|
}
|