admin
25 lines
1.1 KiB
JavaScript
Executable File
25 lines
1.1 KiB
JavaScript
Executable File
export async function registerSecurityHeaders(fastify) {
|
|
fastify.addHook('onSend', async (request, reply) => {
|
|
reply.header('X-Content-Type-Options', 'nosniff')
|
|
reply.header('X-Frame-Options', 'DENY')
|
|
reply.header('X-XSS-Protection', '0')
|
|
reply.header('Referrer-Policy', 'strict-origin-when-cross-origin')
|
|
reply.header('Permissions-Policy', 'camera=(), microphone=(), geolocation=()')
|
|
|
|
const cspDirectives = [
|
|
"default-src 'self'",
|
|
"script-src 'self' https://*.yookassa.ru https://*.vk.com https://oauth.yandex.ru",
|
|
"style-src 'self' 'unsafe-inline' https://fonts.googleapis.com",
|
|
"img-src 'self' data: blob: https://tile.openstreetmap.org https://*.yookassa.ru https://*.vk.com https://oauth.yandex.ru",
|
|
"font-src 'self' https://fonts.gstatic.com",
|
|
"connect-src 'self' https://*.yookassa.ru https://*.vk.com https://oauth.yandex.ru",
|
|
'frame-src https://*.yookassa.ru',
|
|
"object-src 'none'",
|
|
"base-uri 'self'",
|
|
"form-action 'self'",
|
|
].join('; ')
|
|
|
|
reply.header('Content-Security-Policy', cspDirectives)
|
|
})
|
|
}
|