fies

src/app.rs

@@ -1,7 +1,8 @@
 use axum::{
     Router,
-    extract::{DefaultBodyLimit, Path, State},
+    extract::{DefaultBodyLimit, Path, Request, State},
     http::{HeaderName, HeaderValue, StatusCode, header},
+    middleware::{self, Next},
     response::{Html, IntoResponse, Response},
     routing::{get, post},
 };
@@ -170,24 +171,10 @@ pub fn router(
         .layer(DefaultBodyLimit::max(
             upload_max_size_bytes.saturating_add(1024 * 1024),
         ))
-        .layer(SetResponseHeaderLayer::if_not_present(
-            HeaderName::from_static("x-content-type-options"),
-            HeaderValue::from_static("nosniff"),
-        ))
         .layer(SetResponseHeaderLayer::if_not_present(
             HeaderName::from_static("x-frame-options"),
             HeaderValue::from_static("DENY"),
         ))
-        .layer(SetResponseHeaderLayer::if_not_present(
-            HeaderName::from_static("referrer-policy"),
-            HeaderValue::from_static("strict-origin-when-cross-origin"),
-        ))
-        .layer(SetResponseHeaderLayer::if_not_present(
-            HeaderName::from_static("permissions-policy"),
-            HeaderValue::from_static(
-                "camera=(), microphone=(), geolocation=(), payment=(), usb=()",
-            ),
-        ))
         .layer(SetResponseHeaderLayer::if_not_present(
             HeaderName::from_static("cross-origin-opener-policy"),
             HeaderValue::from_static("same-origin"),
@@ -197,9 +184,32 @@ pub fn router(
             HeaderValue::from_static("same-origin"),
         ))
         .layer(TraceLayer::new_for_http())
+        .layer(middleware::from_fn(add_non_asset_security_headers))
         .with_state(state)
 }
 
+async fn add_non_asset_security_headers(request: Request, next: Next) -> Response {
+    let is_asset = request.uri().path().starts_with("/assets/");
+    let mut response = next.run(request).await;
+
+    if !is_asset {
+        let headers = response.headers_mut();
+        headers
+            .entry("x-content-type-options")
+            .or_insert(HeaderValue::from_static("nosniff"));
+        headers
+            .entry("referrer-policy")
+            .or_insert(HeaderValue::from_static("strict-origin-when-cross-origin"));
+        headers
+            .entry("permissions-policy")
+            .or_insert(HeaderValue::from_static(
+                "camera=(), microphone=(), geolocation=(), payment=(), usb=()",
+            ));
+    }
+
+    response
+}
+
 async fn private_workspace_error(State(state): State<SharedState>) -> Response {
     error_response(
         StatusCode::FORBIDDEN,