1 // SPDX-License-Identifier: Apache-2.0
2 // SPDX-FileCopyrightText: Copyright OpenBMC Authors
3 #pragma once
4
5 #include "http_response.hpp"
6
7 #include <boost/beast/http/field.hpp>
8
addSecurityHeaders(crow::Response & res)9 inline void addSecurityHeaders(crow::Response& res)
10 {
11 using bf = boost::beast::http::field;
12
13 // Recommendations from https://owasp.org/www-project-secure-headers/
14 // https://owasp.org/www-project-secure-headers/ci/headers_add.json
15 res.addHeader(bf::strict_transport_security, "max-age=31536000; "
16 "includeSubdomains");
17
18 res.addHeader(bf::pragma, "no-cache");
19
20 if (res.getHeaderValue(bf::cache_control).empty())
21 {
22 res.addHeader(bf::cache_control, "no-store, max-age=0");
23 }
24 res.addHeader("X-Content-Type-Options", "nosniff");
25
26 std::string_view contentType = res.getHeaderValue("Content-Type");
27 if (contentType.starts_with("text/html"))
28 {
29 res.addHeader(bf::x_frame_options, "DENY");
30 res.addHeader("Referrer-Policy", "no-referrer");
31 res.addHeader(
32 "Permissions-Policy",
33 "accelerometer=(),"
34 "ambient-light-sensor=(),"
35 "autoplay=(),"
36 "battery=(),"
37 "camera=(),"
38 "display-capture=(),"
39 "document-domain=(),"
40 "encrypted-media=(),"
41 "fullscreen=(),"
42 "gamepad=(),"
43 "geolocation=(),"
44 "gyroscope=(),"
45 "layout-animations=(self),"
46 "legacy-image-formats=(self),"
47 "magnetometer=(),"
48 "microphone=(),"
49 "midi=(),"
50 "oversized-images=(self),"
51 "payment=(),"
52 "picture-in-picture=(),"
53 "publickey-credentials-get=(),"
54 "speaker-selection=(),"
55 "sync-xhr=(self),"
56 "unoptimized-images=(self),"
57 "unsized-media=(self),"
58 "usb=(),"
59 "screen-wak-lock=(),"
60 "web-share=(),"
61 "xr-spatial-tracking=()");
62 res.addHeader("X-Permitted-Cross-Domain-Policies", "none");
63 res.addHeader("Cross-Origin-Embedder-Policy", "require-corp");
64 res.addHeader("Cross-Origin-Opener-Policy", "same-origin");
65 res.addHeader("Cross-Origin-Resource-Policy", "same-origin");
66 res.addHeader("Content-Security-Policy",
67 "default-src 'none'; "
68 "img-src 'self' data:; "
69 "font-src 'self'; "
70 "style-src 'self'; "
71 "script-src 'self'; "
72 "connect-src 'self' wss:; "
73 "form-action 'none'; "
74 "frame-ancestors 'none'; "
75 "object-src 'none'; "
76 "base-uri 'none' ");
77 // The KVM currently needs to load images from base64 encoded
78 // strings. img-src 'self' data: is used to allow that.
79 // https://stackoverflow.com/questions/18447970/content-security-polic
80 // y-data-not-working-for-base64-images-in-chrome-28
81 }
82 }
83