mirrors/owncast
1
0
Fork 0
mirror of https://github.com/owncast/owncast.git synced 2024-11-21 20:28:15 +03:00
Code Issues Projects Releases Packages Wiki Activity

Merge pull request from GHSA-2hfj-cxw7-g45p

Browse source
This commit is contained in:
Gabe Kangas 2021-08-30 19:43:28 -07:00 committed by GitHub
parent 663a7b5fe1
commit 7278ce8f26
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
3 changed files with 21 additions and 10 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
controllers/index.go
View file

@ -68,8 +68,8 @@ func IndexHandler(w http.ResponseWriter, r *http.Request) {
// Set a cache control max-age header
middleware.SetCachingHeaders(w, r)
// Opt-out of Google FLoC
middleware.DisableFloc(w)
// Set our global HTTP headers
middleware.SetHeaders(w)
http.ServeFile(w, r, path.Join(config.WebRoot, r.URL.Path))
}

8
router/middleware/disableFloc.go
View file

@ -1,8 +0,0 @@
package middleware
import "net/http"
// DisableFloc will tell Google to not use this response in their FLoC tracking.
func DisableFloc(w http.ResponseWriter) {
w.Header().Set("Permissions-Policy", "interest-cohort=()")
}

19
router/middleware/headers.go Normal file
View file

@ -0,0 +1,19 @@
package middleware
import (
"net/http"
"strings"
)
// SetHeaders will set our global headers for web resources.
func SetHeaders(w http.ResponseWriter) {
// Tell Google to not use this response in their FLoC tracking.
w.Header().Set("Permissions-Policy", "interest-cohort=()")
// Content security policy
csp := []string{
"script-src 'self' 'sha256-2HPCfJIJHnY0NrRDPTOdC7AOSJIcQyNxzUuut3TsYRY='",
"worker-src 'self' blob:", // No single quotes around blob:
}
w.Header().Set("Content-Security-Policy", strings.Join(csp, "; "))
}