mirror of
https://github.com/UNITRONIX/BetterDesk.git
synced 2026-09-10 01:27:11 +00:00
UNITRONIX
95 lines
3.3 KiB
JavaScript
95 lines
3.3 KiB
JavaScript
/**
|
|
* BetterDesk Console - Security Middleware
|
|
* Configures Helmet and custom security headers
|
|
*/
|
|
|
|
const helmet = require('helmet');
|
|
const config = require('../config/config');
|
|
|
|
/**
|
|
* Build CSP connect-src based on HTTPS mode
|
|
* Allow WebSocket connections (ws:// or wss:// depending on mode)
|
|
*/
|
|
const connectSources = config.httpsEnabled
|
|
? ["'self'", "wss:"]
|
|
: ["'self'", "ws:"];
|
|
|
|
/**
|
|
* Configure Helmet with hardened CSP
|
|
* - unsafe-eval: required by protobuf.js codegen (pinned to that library)
|
|
* - unsafe-inline for scripts: required for EJS inline handlers + page scripts
|
|
* - unsafe-inline for styles: required for dynamic theming via branding service
|
|
*/
|
|
const helmetMiddleware = helmet({
|
|
contentSecurityPolicy: {
|
|
directives: {
|
|
defaultSrc: ["'self'"],
|
|
scriptSrc: ["'self'", "'unsafe-inline'", "'unsafe-eval'"],
|
|
scriptSrcAttr: ["'unsafe-inline'"],
|
|
styleSrc: ["'self'", "'unsafe-inline'", "https://fonts.googleapis.com"],
|
|
fontSrc: ["'self'", "https://fonts.gstatic.com"],
|
|
imgSrc: ["'self'", "data:", "blob:"],
|
|
mediaSrc: ["'self'", "blob:"],
|
|
connectSrc: connectSources,
|
|
frameSrc: ["'self'"],
|
|
objectSrc: ["'none'"],
|
|
childSrc: ["'self'"],
|
|
workerSrc: ["'self'", "blob:"],
|
|
baseUri: ["'self'"],
|
|
formAction: ["'self'"],
|
|
frameAncestors: ["'self'"],
|
|
upgradeInsecureRequests: config.httpsEnabled ? [] : null
|
|
}
|
|
},
|
|
crossOriginEmbedderPolicy: false,
|
|
crossOriginResourcePolicy: { policy: 'same-origin' },
|
|
crossOriginOpenerPolicy: config.httpsEnabled ? { policy: 'same-origin' } : false,
|
|
originAgentCluster: config.httpsEnabled,
|
|
strictTransportSecurity: config.httpsEnabled
|
|
? { maxAge: 31536000, includeSubDomains: true, preload: false }
|
|
: false,
|
|
dnsPrefetchControl: { allow: false },
|
|
referrerPolicy: { policy: 'strict-origin-when-cross-origin' }
|
|
});
|
|
|
|
/**
|
|
* Custom security headers beyond what Helmet provides
|
|
*/
|
|
function customSecurityHeaders(req, res, next) {
|
|
// Prevent clickjacking (belt + suspenders with CSP frame-ancestors)
|
|
res.setHeader('X-Frame-Options', 'SAMEORIGIN');
|
|
|
|
// Prevent MIME type sniffing
|
|
res.setHeader('X-Content-Type-Options', 'nosniff');
|
|
|
|
// XSS Protection (disabled — CSP is the modern replacement)
|
|
res.setHeader('X-XSS-Protection', '0');
|
|
|
|
// Permissions policy — restrict powerful APIs
|
|
res.setHeader('Permissions-Policy',
|
|
'geolocation=(), microphone=(self), camera=(), ' +
|
|
'browsing-topics=(), payment=(), usb=(), ' +
|
|
'accelerometer=(), gyroscope=(), magnetometer=()');
|
|
|
|
// Prevent cross-site leak via cache timing
|
|
res.setHeader('Cache-Control', 'no-store');
|
|
// Allow static assets to be cached (overridden in express.static options)
|
|
if (req.path.startsWith('/css/') || req.path.startsWith('/js/') ||
|
|
req.path.startsWith('/img/') || req.path.startsWith('/fonts/')) {
|
|
res.setHeader('Cache-Control', 'public, max-age=3600');
|
|
}
|
|
|
|
next();
|
|
}
|
|
|
|
/**
|
|
* Combined security middleware
|
|
*/
|
|
function securityMiddleware(req, res, next) {
|
|
helmetMiddleware(req, res, () => {
|
|
customSecurityHeaders(req, res, next);
|
|
});
|
|
}
|
|
|
|
module.exports = securityMiddleware;
|