Added more security in HTTP headers
Ylian Saint-Hilaire committed
Sep 12, 2019 at 15:12 UTC
ab3f974810237d23b046d37c46a1c43ca918ead4
4 files changed
+20
-5
package.json
+1
-1
@@ -1,6 +1,6 @@
1
{
2
"name": "meshcentral",
3
- "version": "0.4.0-l",
3
+ "version": "0.4.0-n",
4
"keywords": [
5
"Remote Management",
6
"Intel AMT",
sample-config.json
+5
-1
@@ -102,7 +102,11 @@
102
"meshcommander": "https://www.meshcommander.com/"
103
},
104
"_yubikey": { "id": "0000", "secret": "xxxxxxxxxxxxxxxxxxxxx", "_proxy": "http://myproxy.domain.com:80" },
105
- "_httpheaders": { "Strict-Transport-Security": "max-age=360000" },
105
+ "_httpheaders": {
106
+ "Strict-Transport-Security": "max-age=360000",
107
+ "x-frame-options": "SAMEORIGIN",
108
+ "Content-Security-Policy": "default-src 'none'; script-src 'self' 'unsafe-inline'; connect-src 'self'; img-src 'self' data:; style-src 'self' 'unsafe-inline'; frame-src 'self'; media-src 'self'"
109
+ },
110
"_agentConfig": [ "webSocketMaskOverride=1" ],
111
"_SessionRecording": {
112
"_filepath": "C:\\temp",
views/default.handlebars
+2
-2
@@ -1084,7 +1084,7 @@
1084
//window.addEventListener("focus", ondocfocus, false);
1085
window.addEventListener("blur", ondocblur, false);
1086
window.onresize = function () { masterUpdate(512); }
1087
- setTimeout("masterUpdate(512)", 200);
1087
+ setTimeout(function() { masterUpdate(512); }, 200);
1088
1089
// Connect to the mesh server
1090
meshserver = MeshServerCreateControl(domainUrl, authCookie);
@@ -2197,7 +2197,7 @@
2197
putstore("_deviceView", Q('viewselect').value);
2198
putstore("_viewsize", Q('sizeselect').value);
2199
masterUpdate(4);
2200
- setTimeout("masterUpdate(512)", 200);
2200
+ setTimeout(function () { masterUpdate(512); }, 200);
2201
}
2202
2203
function ondockeypress(e) {
webserver.js
+12
-1
@@ -3146,7 +3146,18 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
3146
// If this domain has configured headers, use them.
3147
// Example headers: { 'Strict-Transport-Security': 'max-age=360000;includeSubDomains' };
3148
// { 'Referrer-Policy': 'no-referrer', 'x-frame-options': 'SAMEORIGIN', 'X-XSS-Protection': '1; mode=block', 'X-Content-Type-Options': 'nosniff', 'Content-Security-Policy': "default-src http: ws: data: 'self';script-src http: 'unsafe-inline';style-src http: 'unsafe-inline'" };
3149
- if ((domain != null) && (domain.httpheaders != null) && (typeof domain.httpheaders == 'object')) { res.set(domain.httpheaders); }
3149
+ if ((domain != null) && (domain.httpheaders != null) && (typeof domain.httpheaders == 'object')) {
3150
+ res.set(domain.httpheaders);
3151
+ } else {
3152
+ // Use default security headers
3153
+ res.set({
3154
+ "X-Frame-Options": "sameorigin",
3155
+ "Referrer-Policy": "no-referrer",
3156
+ "X-XSS-Protection": "1; mode=block",
3157
+ "X-Content-Type-Options": "nosniff",
3158
+ "Content-Security-Policy": "default-src 'none'; script-src 'self' 'unsafe-inline'; connect-src 'self'; img-src 'self' data:; style-src 'self' 'unsafe-inline'; frame-src 'self'; media-src 'self'"
3159
+ });
3160
+ }
3161
3162
// Detect if this is a file sharing domain, if so, just share files.
3163
if ((domain != null) && (domain.share != null)) {