mirror/prysm-pulse
1
0
Fork 0
mirror of https://gitlab.com/pulsechaincom/prysm-pulse.git synced 2025-01-03 00:27:38 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Add WebUI Security Headers (#9775)

Browse Source
This commit is contained in:
Raul Jordan 2021-10-15 05:40:23 -05:00 committed by GitHub
parent 59547aea66
commit 4dbb5d6974
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 16 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
validator/web/BUILD.bazel
View File

@ -9,6 +9,7 @@ go_library(
"doc.go",
"handler.go",
"log.go",
"headers.go",
":site_data", # keep
],
importpath = "github.com/prysmaticlabs/prysm/validator/web",

1
validator/web/handler.go
View File

@ -11,6 +11,7 @@ const prefix = "external/prysm_web_ui/prysm-web-ui"
// Handler serves web requests from the bundled site data.
var Handler = func(res http.ResponseWriter, req *http.Request) {
addSecurityHeaders(res)
u, err := url.ParseRequestURI(req.RequestURI)
if err != nil {
log.WithError(err).Error("Cannot parse request URI")

14
validator/web/headers.go Normal file
View File

@ -0,0 +1,14 @@
package web
import "net/http"
func addSecurityHeaders(w http.ResponseWriter) {
// Deny displaying the web UI in any iframe.
w.Header().Add("X-Frame-Options", "DENY")
// Prevent xss in case a malicious HTML markup is served in any page.
w.Header().Add("X-Content-Type-Options", "nosniff")
// Prevent opening site in pop-up window to exploit cross-site leaks.
w.Header().Add("Cross-Origin-Opener-Policy", "same-origin-allow-popups")
// Prevent embedding from another resource.
w.Header().Add("Cross-Origin-Resource-Policy", "same-origin")
}