mirror of
https://github.com/kingomarnajjar/flex-template-web.git
synced 2026-07-26 06:47:17 +10:00
117 lines
2.9 KiB
JavaScript
117 lines
2.9 KiB
JavaScript
const helmet = require('helmet');
|
|
|
|
const dev = process.env.REACT_APP_ENV === 'development';
|
|
const self = "'self'";
|
|
const unsafeInline = "'unsafe-inline'";
|
|
const unsafeEval = "'unsafe-eval'";
|
|
const data = 'data:';
|
|
const blob = 'blob:';
|
|
const devImagesMaybe = dev ? ['*.localhost:8000'] : [];
|
|
|
|
// Default CSP whitelist.
|
|
//
|
|
// NOTE: Do not change these in the customizations, make custom
|
|
// additions within the exported function in the bottom of this file.
|
|
const defaultDirectives = {
|
|
baseUri: [self],
|
|
defaultSrc: [self],
|
|
childSrc: [blob],
|
|
connectSrc: [
|
|
self,
|
|
process.env.REACT_APP_SHARETRIBE_SDK_BASE_URL,
|
|
'maps.googleapis.com',
|
|
'*.tiles.mapbox.com',
|
|
'api.mapbox.com',
|
|
|
|
// Google Analytics
|
|
'www.google-analytics.com',
|
|
'stats.g.doubleclick.net',
|
|
|
|
'sentry.io',
|
|
'*.stripe.com',
|
|
],
|
|
fontSrc: [self, data, 'assets-sharetribecom.sharetribe.com', 'fonts.gstatic.com'],
|
|
frameSrc: [self, '*.stripe.com'],
|
|
imgSrc: [
|
|
self,
|
|
data,
|
|
blob,
|
|
...devImagesMaybe,
|
|
'*.imgix.net',
|
|
'sharetribe.imgix.net', // Safari 9.1 didn't recognize asterisk rule.
|
|
|
|
// Styleguide placeholder images
|
|
'lorempixel.com',
|
|
'via.placeholder.com',
|
|
|
|
'api.mapbox.com',
|
|
'maps.googleapis.com',
|
|
'*.gstatic.com',
|
|
'*.googleapis.com',
|
|
'*.ggpht.com',
|
|
|
|
// Google Analytics
|
|
'www.google.com',
|
|
'www.google-analytics.com',
|
|
'stats.g.doubleclick.net',
|
|
|
|
'*.stripe.com',
|
|
],
|
|
scriptSrc: [
|
|
self,
|
|
unsafeInline,
|
|
unsafeEval,
|
|
data,
|
|
'maps.googleapis.com',
|
|
'api.mapbox.com',
|
|
'*.google-analytics.com',
|
|
'js.stripe.com',
|
|
],
|
|
styleSrc: [self, unsafeInline, 'fonts.googleapis.com', 'api.mapbox.com'],
|
|
};
|
|
|
|
/**
|
|
* Middleware for creating a Content Security Policy
|
|
*
|
|
* @param {String} reportUri URL where the browser will POST the
|
|
* policy violation reports
|
|
*
|
|
* @param {Boolean} enforceSsl When SSL is enforced, all mixed content
|
|
* is blocked/reported by the policy
|
|
*
|
|
* @param {Boolean} reportOnly In the report mode, requests are only
|
|
* reported to the report URL instead of blocked
|
|
*/
|
|
module.exports = (reportUri, enforceSsl, reportOnly) => {
|
|
// ================ START CUSTOM CSP URLs ================ //
|
|
|
|
// Add custom CSP whitelisted URLs here. See commented example
|
|
// below. For format specs and examples, see:
|
|
// https://content-security-policy.com/
|
|
|
|
// Example: extend default img directive with custom domain
|
|
// const { imgSrc = [self] } = defaultDirectives;
|
|
// const exampleImgSrc = imgSrc.concat('my-custom-domain.example.com');
|
|
|
|
const customDirectives = {
|
|
// Example: Add custom directive override
|
|
// imgSrc: exampleImgSrc,
|
|
};
|
|
|
|
// ================ END CUSTOM CSP URLs ================ //
|
|
|
|
const directives = Object.assign(
|
|
{
|
|
reportUri,
|
|
blockAllMixedContent: enforceSsl,
|
|
},
|
|
defaultDirectives,
|
|
customDirectives
|
|
);
|
|
|
|
// See: https://helmetjs.github.io/docs/csp/
|
|
return helmet.contentSecurityPolicy({
|
|
directives,
|
|
reportOnly,
|
|
});
|
|
};
|