2015-08-04 08:25:34 +00:00
|
|
|
import helmet from 'helmet';
|
|
|
|
|
2018-10-05 09:17:34 +00:00
|
|
|
import { homeLocation } from '../../../config/env';
|
|
|
|
|
2015-12-23 03:33:25 +00:00
|
|
|
let trusted = [
|
2018-02-12 22:38:42 +00:00
|
|
|
"'self'",
|
2018-03-07 15:04:42 +00:00
|
|
|
'https://search.freecodecamp.org',
|
2018-10-05 09:17:34 +00:00
|
|
|
homeLocation,
|
2018-06-28 09:32:22 +00:00
|
|
|
'https://' + process.env.AUTH0_DOMAIN
|
2015-08-04 08:25:34 +00:00
|
|
|
];
|
|
|
|
|
2017-02-22 13:04:21 +00:00
|
|
|
const host = process.env.HOST || 'localhost';
|
2017-04-21 10:51:55 +00:00
|
|
|
const port = process.env.SYNC_PORT || '3000';
|
2017-02-22 13:04:21 +00:00
|
|
|
|
2015-12-23 03:33:25 +00:00
|
|
|
if (process.env.NODE_ENV !== 'production') {
|
2018-10-05 09:17:34 +00:00
|
|
|
trusted = trusted.concat([`ws://${host}:${port}`, 'http://localhost:8000']);
|
2015-12-23 03:33:25 +00:00
|
|
|
}
|
|
|
|
|
2015-08-04 08:25:34 +00:00
|
|
|
export default function csp() {
|
2016-05-03 18:32:28 +00:00
|
|
|
return helmet.contentSecurityPolicy({
|
2016-01-13 05:45:15 +00:00
|
|
|
directives: {
|
2016-07-29 03:01:17 +00:00
|
|
|
defaultSrc: trusted.concat([
|
|
|
|
'https://*.cloudflare.com',
|
2018-06-28 15:31:29 +00:00
|
|
|
'*.cloudflare.com'
|
2016-07-29 03:01:17 +00:00
|
|
|
]),
|
2017-01-27 05:07:22 +00:00
|
|
|
connectSrc: trusted.concat([
|
2017-03-24 02:26:45 +00:00
|
|
|
'https://glitch.com',
|
|
|
|
'https://*.glitch.com',
|
|
|
|
'https://*.glitch.me',
|
2018-08-15 09:32:41 +00:00
|
|
|
'https://*.cloudflare.com',
|
|
|
|
'https://*.algolia.net'
|
2017-01-27 05:07:22 +00:00
|
|
|
]),
|
2016-01-13 05:45:15 +00:00
|
|
|
scriptSrc: [
|
|
|
|
"'unsafe-eval'",
|
|
|
|
"'unsafe-inline'",
|
|
|
|
'*.google-analytics.com',
|
|
|
|
'*.gstatic.com',
|
|
|
|
'https://*.cloudflare.com',
|
|
|
|
'*.cloudflare.com',
|
|
|
|
'https://*.gitter.im',
|
|
|
|
'https://*.cdnjs.com',
|
|
|
|
'*.cdnjs.com',
|
|
|
|
'https://*.jsdelivr.com',
|
|
|
|
'*.jsdelivr.com',
|
|
|
|
'*.twimg.com',
|
|
|
|
'https://*.twimg.com',
|
2016-05-04 17:30:47 +00:00
|
|
|
'*.youtube.com',
|
2018-06-28 15:31:29 +00:00
|
|
|
'*.ytimg.com'
|
2016-01-13 05:45:15 +00:00
|
|
|
].concat(trusted),
|
|
|
|
styleSrc: [
|
|
|
|
"'unsafe-inline'",
|
|
|
|
'*.gstatic.com',
|
|
|
|
'*.googleapis.com',
|
|
|
|
'*.bootstrapcdn.com',
|
|
|
|
'https://*.bootstrapcdn.com',
|
|
|
|
'*.cloudflare.com',
|
2016-10-25 16:59:25 +00:00
|
|
|
'https://*.cloudflare.com',
|
2018-07-31 15:25:03 +00:00
|
|
|
'https://use.fontawesome.com'
|
2016-01-13 05:45:15 +00:00
|
|
|
].concat(trusted),
|
|
|
|
fontSrc: [
|
|
|
|
'*.cloudflare.com',
|
|
|
|
'https://*.cloudflare.com',
|
|
|
|
'*.bootstrapcdn.com',
|
|
|
|
'*.googleapis.com',
|
|
|
|
'*.gstatic.com',
|
2018-08-15 09:32:41 +00:00
|
|
|
'https://*.bootstrapcdn.com',
|
|
|
|
'https://use.fontawesome.com'
|
2016-01-13 05:45:15 +00:00
|
|
|
].concat(trusted),
|
|
|
|
imgSrc: [
|
|
|
|
// allow all input since we have user submitted images for
|
|
|
|
// public profile
|
|
|
|
'*',
|
|
|
|
'data:'
|
|
|
|
],
|
2018-10-05 09:17:34 +00:00
|
|
|
mediaSrc: ['*.bitly.com', '*.amazonaws.com', '*.twitter.com'].concat(
|
|
|
|
trusted
|
|
|
|
),
|
2016-01-13 05:45:15 +00:00
|
|
|
frameSrc: [
|
|
|
|
'*.gitter.im',
|
|
|
|
'*.gitter.im https:',
|
2016-04-19 07:23:27 +00:00
|
|
|
'*.youtube.com',
|
2016-01-13 05:45:15 +00:00
|
|
|
'*.twitter.com',
|
|
|
|
'*.ghbtns.com',
|
2016-02-10 04:22:42 +00:00
|
|
|
'*.freecatphotoapp.com',
|
2016-02-14 02:26:59 +00:00
|
|
|
'freecodecamp.github.io'
|
2016-01-13 05:45:15 +00:00
|
|
|
].concat(trusted)
|
|
|
|
},
|
2015-08-04 08:25:34 +00:00
|
|
|
// set to true if you only want to report errors
|
|
|
|
reportOnly: false,
|
|
|
|
// set to true if you want to set all headers
|
|
|
|
setAllHeaders: false,
|
|
|
|
// set to true if you want to force buggy CSP in Safari 5
|
|
|
|
safari5: false
|
|
|
|
});
|
|
|
|
}
|