1 // SPDX-License-Identifier: Apache-2.0 2 // SPDX-FileCopyrightText: Copyright OpenBMC Authors 3 #pragma once 4 5 #include "http_response.hpp" 6 7 #include <boost/beast/http/field.hpp> 8 9 inline void addSecurityHeaders(crow::Response& res) 10 { 11 using bf = boost::beast::http::field; 12 13 // Recommendations from https://owasp.org/www-project-secure-headers/ 14 // https://owasp.org/www-project-secure-headers/ci/headers_add.json 15 res.addHeader(bf::strict_transport_security, "max-age=31536000; " 16 "includeSubdomains"); 17 18 res.addHeader(bf::pragma, "no-cache"); 19 20 if (res.getHeaderValue(bf::cache_control).empty()) 21 { 22 res.addHeader(bf::cache_control, "no-store, max-age=0"); 23 } 24 res.addHeader("X-Content-Type-Options", "nosniff"); 25 26 std::string_view contentType = res.getHeaderValue("Content-Type"); 27 if (contentType.starts_with("text/html")) 28 { 29 res.addHeader(bf::x_frame_options, "DENY"); 30 res.addHeader("Referrer-Policy", "no-referrer"); 31 res.addHeader( 32 "Permissions-Policy", 33 "accelerometer=()," 34 "ambient-light-sensor=()," 35 "autoplay=()," 36 "battery=()," 37 "camera=()," 38 "display-capture=()," 39 "document-domain=()," 40 "encrypted-media=()," 41 "fullscreen=()," 42 "gamepad=()," 43 "geolocation=()," 44 "gyroscope=()," 45 "layout-animations=(self)," 46 "legacy-image-formats=(self)," 47 "magnetometer=()," 48 "microphone=()," 49 "midi=()," 50 "oversized-images=(self)," 51 "payment=()," 52 "picture-in-picture=()," 53 "publickey-credentials-get=()," 54 "speaker-selection=()," 55 "sync-xhr=(self)," 56 "unoptimized-images=(self)," 57 "unsized-media=(self)," 58 "usb=()," 59 "screen-wak-lock=()," 60 "web-share=()," 61 "xr-spatial-tracking=()"); 62 res.addHeader("X-Permitted-Cross-Domain-Policies", "none"); 63 res.addHeader("Cross-Origin-Embedder-Policy", "require-corp"); 64 res.addHeader("Cross-Origin-Opener-Policy", "same-origin"); 65 res.addHeader("Cross-Origin-Resource-Policy", "same-origin"); 66 res.addHeader("Content-Security-Policy", 67 "default-src 'none'; " 68 "img-src 'self' data:; " 69 "font-src 'self'; " 70 "style-src 'self'; " 71 "script-src 'self'; " 72 "connect-src 'self' wss:; " 73 "form-action 'none'; " 74 "frame-ancestors 'none'; " 75 "object-src 'none'; " 76 "base-uri 'none' "); 77 // The KVM currently needs to load images from base64 encoded 78 // strings. img-src 'self' data: is used to allow that. 79 // https://stackoverflow.com/questions/18447970/content-security-polic 80 // y-data-not-working-for-base64-images-in-chrome-28 81 } 82 } 83