maverick/flex-template-web
1
0
Fork 0
mirror of https://github.com/kingomarnajjar/flex-template-web.git synced 2026-07-26 06:47:17 +10:00
Code Issues Projects Releases Packages Wiki Activity Actions

Merge pull request #768 from sharetribe/csp-additions

Browse source 
Improve CSP error messages
This commit is contained in:
Kimmo Puputti 2018-03-20 11:17:03 +02:00 • committed by GitHub
commit e116c1cd6a
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 11 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
server/csp.js
View file

@ -81,7 +81,7 @@ module.exports = (reportUri, enforceSsl, reportOnly) => {
// https://content-security-policy.com/
// Example: extend default img directive with custom domain
// const { imgSrc = [] } = defaultDirectives;
// const { imgSrc = [self] } = defaultDirectives;
// const exampleImgSrc = imgSrc.concat('my-custom-domain.example.com');
const customDirectives = {

12
server/index.js
View file

@ -239,10 +239,18 @@ app.get('*', (req, res) => {
app.use(log.errorHandler());
if (cspEnabled) {
// Dig out the value of the given CSP report key from the request body.
const reportValue = (req, key) => {
const report = req.body ? req.body['csp-report'] : null;
return report && report[key] ? report[key] : key;
};
// Handler for CSP violation reports.
app.post(cspReportUrl, (req, res) => {
const report = req.body ? req.body['csp-report'] : null;
log.error(new Error('CSP violation'), 'csp-violation', report);
const effectiveDirective = reportValue(req, 'effective-directive');
const blockedUri = reportValue(req, 'blocked-uri');
const msg = `CSP: ${effectiveDirective} doesn't allow ${blockedUri}`;
log.error(new Error(msg), 'csp-violation');
res.status(204).end();
});
}