-
Notifications
You must be signed in to change notification settings - Fork 7
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
browser security policy headers for text/html and static content urls
Removes in-line style and event handlers not compatible with header security policies. All event handlers now registered via main.js window event-handler on 'DOMContentLoaded'.
- Loading branch information
Showing
13 changed files
with
622 additions
and
494 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
36 changes: 36 additions & 0 deletions
36
...erver/src/main/java/dev/dsf/fhir/webservice/filter/BrowserPolicyHeaderResponseFilter.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,36 @@ | ||
| package dev.dsf.fhir.webservice.filter; | ||
|
|
||
| import java.io.IOException; | ||
|
|
||
| import jakarta.ws.rs.container.ContainerRequestContext; | ||
| import jakarta.ws.rs.container.ContainerResponseContext; | ||
| import jakarta.ws.rs.container.ContainerResponseFilter; | ||
| import jakarta.ws.rs.core.MediaType; | ||
| import jakarta.ws.rs.core.MultivaluedMap; | ||
| import jakarta.ws.rs.ext.Provider; | ||
|
|
||
| @Provider | ||
| public class BrowserPolicyHeaderResponseFilter implements ContainerResponseFilter | ||
| { | ||
| @Override | ||
| public void filter(ContainerRequestContext requestContext, ContainerResponseContext responseContext) | ||
| throws IOException | ||
| { | ||
| if ((requestContext.getAcceptableMediaTypes() != null | ||
| && requestContext.getAcceptableMediaTypes().contains(MediaType.TEXT_HTML_TYPE)) | ||
| || (requestContext.getUriInfo() != null && requestContext.getUriInfo().getPath() != null | ||
| && requestContext.getUriInfo().getPath().startsWith("static/"))) | ||
| { | ||
| MultivaluedMap<String, Object> headers = responseContext.getHeaders(); | ||
|
|
||
| headers.add("X-Content-Type-Options", "nosniff"); | ||
| headers.add("Referrer-Policy", "strict-origin-when-cross-origin"); | ||
| headers.add("Cross-Origin-Opener-Policy", "same-origin"); | ||
| headers.add("Cross-Origin-Embedder-Policy", "require-corp"); | ||
| headers.add("Cross-Origin-Resource-Policy", "same-site"); | ||
| headers.add("Permissions-Policy", "geolocation=(), camera=(), microphone=()"); | ||
| headers.add("Content-Security-Policy", | ||
| "frame-ancestors 'none'; default-src 'self'; frame-src 'none'; media-src 'none'; object-src 'none'; worker-src 'none'"); | ||
| } | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.