gru/gree-controller
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

v0.12.1-cleanups

Browse Source
This commit is contained in:
Mateusz Gruszczyński
2026-09-04 09:42:43 +02:00
parent 7fd5921ba9
commit 642f43ed9f
12 changed files with 63 additions and 8712 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/api/middleware.rs
+22 -3
View File
@@ -1,6 +1,10 @@
async fn security_headers(request: Request, next: Next) -> Response {
let is_api = request.uri().path().contains("/api/");
let path = request.uri().path();
let is_api = path == "/api" || path.starts_with("/api/");
let is_api_docs = path == "/api-docs" || path.starts_with("/api-docs/");
let mut response = next.run(request).await;
let is_html = response
.headers()
.get(header::CONTENT_TYPE)
@@ -13,6 +17,7 @@ async fn security_headers(request: Request, next: Next) -> Response {
});
let headers = response.headers_mut();
headers.insert(
header::HeaderName::from_static("x-content-type-options"),
HeaderValue::from_static("nosniff"),
@@ -27,7 +32,12 @@ async fn security_headers(request: Request, next: Next) -> Response {
header::HeaderName::from_static("x-frame-options"),
HeaderValue::from_static("SAMEORIGIN"),
);
headers.insert(header::HeaderName::from_static("content-security-policy"), HeaderValue::from_static("default-src 'self'; connect-src 'self' ws: wss:; img-src 'self' data:; style-src 'self' 'unsafe-inline'; script-src 'self'; base-uri 'self'; form-action 'self'; frame-ancestors 'self'; object-src 'none'"));
headers.insert(
header::HeaderName::from_static("content-security-policy"),
HeaderValue::from_static(
"default-src 'self'; connect-src 'self' ws: wss:; img-src 'self' data:; style-src 'self' 'unsafe-inline'; script-src 'self'; base-uri 'self'; form-action 'self'; frame-ancestors 'self'; object-src 'none'"
),
);
headers.insert(
header::HeaderName::from_static("permissions-policy"),
HeaderValue::from_static("camera=(), microphone=(), geolocation=()"),
@@ -35,7 +45,16 @@ async fn security_headers(request: Request, next: Next) -> Response {
}
if is_api {
headers.insert(header::CACHE_CONTROL, HeaderValue::from_static("no-store"));
headers.insert(
header::CACHE_CONTROL,
HeaderValue::from_static("no-cache, no-store"),
);
} else if is_api_docs {
headers.insert(
header::CACHE_CONTROL,
HeaderValue::from_static("no-cache, must-revalidate"),
);
}
response
}