-
-
Notifications
You must be signed in to change notification settings - Fork 7
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Signed-off-by: Andres Correa Casablanca <[email protected]>
- Loading branch information
Showing
27 changed files
with
1,992 additions
and
159 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,3 @@ | ||
| # Astro-Shield Documentation Website | ||
|
|
||
| Just a documentation website. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,65 @@ | ||
| import { defineConfig, passthroughImageService } from 'astro/config' | ||
| import starlight from '@astrojs/starlight' | ||
|
|
||
| // https://astro.build/config | ||
| export default defineConfig({ | ||
| site: 'https://astro-shield.kindspells.dev', | ||
| image: { | ||
| service: passthroughImageService(), | ||
| }, | ||
| integrations: [ | ||
| starlight({ | ||
| title: 'Astro-Shield Docs', | ||
| defaultLocale: 'en', | ||
| locales: { | ||
| root: { | ||
| label: 'English', | ||
| lang: 'en', | ||
| }, | ||
| }, | ||
| social: { | ||
| github: 'https://github.com/kindspells/astro-shield', | ||
| }, | ||
| sidebar: [ | ||
| { | ||
| label: 'Start Here', | ||
| items: [{ label: 'Getting Started', link: '/getting-started/' }], | ||
| }, | ||
| { | ||
| label: 'Guides', | ||
| items: [ | ||
| { | ||
| label: 'Subresource Integrity', | ||
| autogenerate: { | ||
| directory: 'guides/subresource-integrity', | ||
| }, | ||
| }, | ||
| { | ||
| label: 'Security Headers', | ||
| autogenerate: { | ||
| directory: 'guides/security-headers', | ||
| }, | ||
| } | ||
| ], | ||
| }, | ||
| { | ||
| label: 'Other', | ||
| items: [ | ||
| { | ||
| label: 'Known Limitations', | ||
| link: '/other/known-limitations/', | ||
| }, | ||
| { | ||
| label: 'Contributing', | ||
| link: 'https://github.com/kindspells/astro-shield/blob/main/CONTRIBUTING.md', | ||
| }, | ||
| ] | ||
| }, | ||
| // { | ||
| // label: 'Reference', | ||
| // autogenerate: { directory: 'reference' }, | ||
| // }, | ||
| ], | ||
| }), | ||
| ], | ||
| }) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,18 @@ | ||
| # SPDX-FileCopyrightText: 2024 KindSpells Labs S.L. | ||
| # | ||
| # SPDX-License-Identifier: MIT | ||
|
|
||
| type: 'application' | ||
| platform: 'node' | ||
|
|
||
| tasks: | ||
| build: | ||
| command: 'astro check && astro build' | ||
| inputs: | ||
| - 'public/**/*' | ||
| - 'src/**/*' | ||
| - 'astro.config.mjs' | ||
| - 'package.json' | ||
| outputs: | ||
| - '.astro/**/*' | ||
| - 'dist/**/*' |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,21 @@ | ||
| { | ||
| "name": "@kindspells/astro-shield-docs", | ||
| "type": "module", | ||
| "version": "1.4.0", | ||
| "scripts": { | ||
| "dev": "astro dev", | ||
| "start": "astro dev", | ||
| "build": "astro check && astro build", | ||
| "preview": "astro preview", | ||
| "astro": "astro" | ||
| }, | ||
| "dependencies": { | ||
| "sharp": "0.32.6" | ||
| }, | ||
| "devDependencies": { | ||
| "@astrojs/check": "^0.5.10", | ||
| "@astrojs/starlight": "^0.21.2", | ||
| "astro": "^4.5.12", | ||
| "typescript": "^5.4.3" | ||
| } | ||
| } |
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file not shown.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,6 @@ | ||
| import { defineCollection } from 'astro:content'; | ||
| import { docsSchema } from '@astrojs/starlight/schema'; | ||
|
|
||
| export const collections = { | ||
| docs: defineCollection({ schema: docsSchema() }), | ||
| }; |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,49 @@ | ||
| --- | ||
| title: Getting Started | ||
| description: Get started protecting your Astro sites with Astro-Shield. | ||
| --- | ||
|
|
||
| ## Introduction | ||
|
|
||
| Astro-Shield will help you enhance the security of your Astro site by allowing | ||
| you to apply many security best practices, such as: | ||
| - [Subresource Integrity](https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity) | ||
| - [Content Security Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP) | ||
|
|
||
|
|
||
| ## How to install | ||
|
|
||
| import { Code, Tabs, TabItem } from '@astrojs/starlight/components'; | ||
|
|
||
| To install, run the following command in your terminal: | ||
|
|
||
| <Tabs> | ||
| <TabItem label="npm"> | ||
| <Code code="npm install --save-dev @kindspells/astro-shield" lang="bash" /> | ||
| </TabItem> | ||
| <TabItem label="pnpm"> | ||
| <Code code="pnpm add --save-dev @kindspells/astro-shield" lang="bash" /> | ||
| </TabItem> | ||
| <TabItem label="yarn"> | ||
| <Code code="yarn add --dev @kindspells/astro-shield" lang="bash" /> | ||
| </TabItem> | ||
| </Tabs> | ||
|
|
||
| ## Enabling the integration | ||
|
|
||
| In your `astro.config.mjs` file, import the integration and add it to the | ||
| integrations array: | ||
|
|
||
| <Code | ||
| lang="javascript" | ||
| code={` | ||
| import { defineConfig } from 'astro/config' | ||
| import { shield } from '@kindspells/astro-shield' | ||
| export default defineConfig({ | ||
| integrations: [ | ||
| shield({}) | ||
| ] | ||
| }) | ||
| `} | ||
| /> |
60 changes: 60 additions & 0 deletions
60
docs/src/content/docs/guides/security-headers/content-security-policy.mdx
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,60 @@ | ||
| --- | ||
| title: Content-Security-Policy (CSP) | ||
| description: How to configure the Content-Security-Policy headers of your website with Astro-Shield | ||
| --- | ||
|
|
||
| import { Aside, Code } from '@astrojs/starlight/components'; | ||
|
|
||
| To enable the generation of Content-Security-Policy headers for your SSR | ||
| content, you have to set the option `securityHeaders.contentSecurityPolicy` to | ||
| a non-null object. | ||
|
|
||
| If you want more control, then you can set other nested options, such as | ||
| `cspDirectives`. | ||
|
|
||
| <Code | ||
| lang="javascript" | ||
| code={` | ||
| import { resolve } from 'node:path' | ||
| import { defineConfig } from 'astro/config' | ||
| import { shield } from '@kindspells/astro-shield' | ||
| const rootDir = new URL('.', import.meta.url).pathname | ||
| const modulePath = resolve(rootDir, 'src', 'generated', 'sriHashes.mjs') | ||
| export default defineConfig({ | ||
| integrations: [ | ||
| shield({ | ||
| sri: { | ||
| enableMiddleware: true, // MUST be enabled! | ||
| hashesModule: modulePath, // SHOULD be set! | ||
| }, | ||
| // - If set, it controls how the security headers will be generated in the | ||
| // middleware. | ||
| // - If not set, no security headers will be generated in the middleware. | ||
| securityHeaders: { | ||
| // - If set, it controls how the CSP (Content Security Policy) header will | ||
| // be generated in the middleware. | ||
| // - If not set, no CSP header will be generated in the middleware. | ||
| contentSecurityPolicy: { | ||
| // - If set, it controls the "default" CSP directives (they can be | ||
| // overriden at runtime). | ||
| // - If not set, the middleware will use a minimal set of default | ||
| // directives. | ||
| cspDirectives: { | ||
| 'default-src': "'none'", | ||
| } | ||
| } | ||
| } | ||
| }) | ||
| ] | ||
| }) | ||
| `} | ||
| /> | ||
|
|
||
| <Aside type="caution"> | ||
| When enabling CSP headers, you must also set the `sri.enableMiddleware` option | ||
| to `true`. It is also recommended to set the `sri.hashesModule` option. | ||
| </Aside> |
Oops, something went wrong.