mirror of
https://github.com/versia-pub/server.git
synced 2025-12-07 00:48:18 +01:00
refactor(api): 🎨 Add better headers when serving API requests and client requests
This commit is contained in:
Jesse Wierzbinski
parent
4077f937b4
commit
cac726ac1b
212
package.json
212
package.json
|
|
@ -1,109 +1,109 @@
|
||||||
{
|
{
|
||||||
"name": "lysand",
|
"name": "lysand",
|
||||||
"module": "index.ts",
|
"module": "index.ts",
|
||||||
"type": "module",
|
"type": "module",
|
||||||
"version": "0.5.0",
|
"version": "0.5.0",
|
||||||
"description": "A project to build a federated social network",
|
"description": "A project to build a federated social network",
|
||||||
"author": {
|
"author": {
|
||||||
"email": "contact@cpluspatch.com",
|
"email": "contact@cpluspatch.com",
|
||||||
"name": "CPlusPatch",
|
"name": "CPlusPatch",
|
||||||
"url": "https://cpluspatch.com"
|
"url": "https://cpluspatch.com"
|
||||||
},
|
},
|
||||||
"bugs": {
|
"bugs": {
|
||||||
"url": "https://github.com/lysand-org/lysand/issues"
|
"url": "https://github.com/lysand-org/lysand/issues"
|
||||||
},
|
},
|
||||||
"icon": "https://github.com/lysand-org/lysand",
|
"icon": "https://github.com/lysand-org/lysand",
|
||||||
"license": "AGPL-3.0",
|
"license": "AGPL-3.0",
|
||||||
"keywords": ["federated", "activitypub", "bun"],
|
"keywords": ["federated", "activitypub", "bun"],
|
||||||
"workspaces": ["packages/*"],
|
"workspaces": ["packages/*"],
|
||||||
"maintainers": [
|
"maintainers": [
|
||||||
{
|
{
|
||||||
"email": "contact@cpluspatch.com",
|
"email": "contact@cpluspatch.com",
|
||||||
"name": "CPlusPatch",
|
"name": "CPlusPatch",
|
||||||
"url": "https://cpluspatch.com"
|
"url": "https://cpluspatch.com"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"repository": {
|
||||||
|
"type": "git",
|
||||||
|
"url": "git+https://github.com/lysand-org/lysand.git"
|
||||||
|
},
|
||||||
|
"private": true,
|
||||||
|
"scripts": {
|
||||||
|
"dev": "bun run --watch index.ts",
|
||||||
|
"start": "NODE_ENV=production bun run dist/index.js --prod",
|
||||||
|
"lint": "bunx @biomejs/biome check .",
|
||||||
|
"prod-build": "bun run build.ts",
|
||||||
|
"benchmark:timeline": "bun run benchmarks/timelines.ts",
|
||||||
|
"cloc": "cloc . --exclude-dir node_modules,dist,.output,.nuxt,meta,logs,glitch,glitch-dev --exclude-ext sql,log,pem",
|
||||||
|
"cli": "bun run cli.ts"
|
||||||
|
},
|
||||||
|
"trustedDependencies": [
|
||||||
|
"@biomejs/biome",
|
||||||
|
"@fortawesome/fontawesome-common-types",
|
||||||
|
"@fortawesome/free-regular-svg-icons",
|
||||||
|
"@fortawesome/free-solid-svg-icons",
|
||||||
|
"es5-ext",
|
||||||
|
"esbuild",
|
||||||
|
"json-editor-vue",
|
||||||
|
"msgpackr-extract",
|
||||||
|
"nuxt-app",
|
||||||
|
"sharp",
|
||||||
|
"vue-demi"
|
||||||
|
],
|
||||||
|
"devDependencies": {
|
||||||
|
"@biomejs/biome": "^1.7.0",
|
||||||
|
"@types/cli-table": "^0.3.4",
|
||||||
|
"@types/html-to-text": "^9.0.4",
|
||||||
|
"@types/ioredis": "^5.0.0",
|
||||||
|
"@types/jsonld": "^1.5.13",
|
||||||
|
"@types/markdown-it-container": "^2.0.10",
|
||||||
|
"@types/mime-types": "^2.1.4",
|
||||||
|
"@types/pg": "^8.11.5",
|
||||||
|
"bun-types": "latest",
|
||||||
|
"drizzle-kit": "^0.20.14",
|
||||||
|
"typescript": "latest"
|
||||||
|
},
|
||||||
|
"peerDependencies": {
|
||||||
|
"typescript": "^5.3.2"
|
||||||
|
},
|
||||||
|
"dependencies": {
|
||||||
|
"@hackmd/markdown-it-task-lists": "^2.1.4",
|
||||||
|
"@json2csv/plainjs": "^7.0.6",
|
||||||
|
"@shikijs/markdown-it": "^1.3.0",
|
||||||
|
"@tufjs/canonical-json": "^2.0.0",
|
||||||
|
"blurhash": "^2.0.5",
|
||||||
|
"bullmq": "^5.7.1",
|
||||||
|
"chalk": "^5.3.0",
|
||||||
|
"cli-parser": "workspace:*",
|
||||||
|
"cli-table": "^0.3.11",
|
||||||
|
"config-manager": "workspace:*",
|
||||||
|
"drizzle-orm": "^0.30.7",
|
||||||
|
"extract-zip": "^2.0.1",
|
||||||
|
"html-to-text": "^9.0.5",
|
||||||
|
"ioredis": "^5.3.2",
|
||||||
|
"ip-matching": "^2.1.2",
|
||||||
|
"iso-639-1": "^3.1.0",
|
||||||
|
"isomorphic-dompurify": "latest",
|
||||||
|
"jose": "^5.2.4",
|
||||||
|
"linkify-html": "^4.1.3",
|
||||||
|
"linkify-string": "^4.1.3",
|
||||||
|
"linkifyjs": "^4.1.3",
|
||||||
|
"log-manager": "workspace:*",
|
||||||
|
"magic-regexp": "^0.8.0",
|
||||||
|
"markdown-it": "^14.1.0",
|
||||||
|
"markdown-it-anchor": "^8.6.7",
|
||||||
|
"markdown-it-container": "^4.0.0",
|
||||||
|
"markdown-it-toc-done-right": "^4.2.0",
|
||||||
|
"media-manager": "workspace:*",
|
||||||
|
"megalodon": "^10.0.0",
|
||||||
|
"meilisearch": "^0.38.0",
|
||||||
|
"mime-types": "^2.1.35",
|
||||||
|
"oauth4webapi": "^2.4.0",
|
||||||
|
"pg": "^8.11.5",
|
||||||
|
"request-parser": "workspace:*",
|
||||||
|
"sharp": "^0.33.3",
|
||||||
|
"string-comparison": "^1.3.0",
|
||||||
|
"zod": "^3.22.4",
|
||||||
|
"zod-validation-error": "^3.2.0"
|
||||||
}
|
}
|
||||||
],
|
|
||||||
"repository": {
|
|
||||||
"type": "git",
|
|
||||||
"url": "git+https://github.com/lysand-org/lysand.git"
|
|
||||||
},
|
|
||||||
"private": true,
|
|
||||||
"scripts": {
|
|
||||||
"dev": "bun run --watch index.ts",
|
|
||||||
"start": "NODE_ENV=production bun run dist/index.js --prod",
|
|
||||||
"lint": "bunx @biomejs/biome check .",
|
|
||||||
"prod-build": "bun run build.ts",
|
|
||||||
"benchmark:timeline": "bun run benchmarks/timelines.ts",
|
|
||||||
"cloc": "cloc . --exclude-dir node_modules,dist,.output,.nuxt,meta,logs,glitch,glitch-dev --exclude-ext sql,log,pem",
|
|
||||||
"cli": "bun run cli.ts"
|
|
||||||
},
|
|
||||||
"trustedDependencies": [
|
|
||||||
"@biomejs/biome",
|
|
||||||
"@fortawesome/fontawesome-common-types",
|
|
||||||
"@fortawesome/free-regular-svg-icons",
|
|
||||||
"@fortawesome/free-solid-svg-icons",
|
|
||||||
"es5-ext",
|
|
||||||
"esbuild",
|
|
||||||
"json-editor-vue",
|
|
||||||
"msgpackr-extract",
|
|
||||||
"nuxt-app",
|
|
||||||
"sharp",
|
|
||||||
"vue-demi"
|
|
||||||
],
|
|
||||||
"devDependencies": {
|
|
||||||
"@biomejs/biome": "^1.7.0",
|
|
||||||
"@types/cli-table": "^0.3.4",
|
|
||||||
"@types/html-to-text": "^9.0.4",
|
|
||||||
"@types/ioredis": "^5.0.0",
|
|
||||||
"@types/jsonld": "^1.5.13",
|
|
||||||
"@types/markdown-it-container": "^2.0.10",
|
|
||||||
"@types/mime-types": "^2.1.4",
|
|
||||||
"@types/pg": "^8.11.5",
|
|
||||||
"bun-types": "latest",
|
|
||||||
"drizzle-kit": "^0.20.14",
|
|
||||||
"typescript": "latest"
|
|
||||||
},
|
|
||||||
"peerDependencies": {
|
|
||||||
"typescript": "^5.3.2"
|
|
||||||
},
|
|
||||||
"dependencies": {
|
|
||||||
"@hackmd/markdown-it-task-lists": "^2.1.4",
|
|
||||||
"@json2csv/plainjs": "^7.0.6",
|
|
||||||
"@shikijs/markdown-it": "^1.3.0",
|
|
||||||
"@tufjs/canonical-json": "^2.0.0",
|
|
||||||
"blurhash": "^2.0.5",
|
|
||||||
"bullmq": "^5.7.1",
|
|
||||||
"chalk": "^5.3.0",
|
|
||||||
"cli-parser": "workspace:*",
|
|
||||||
"cli-table": "^0.3.11",
|
|
||||||
"config-manager": "workspace:*",
|
|
||||||
"drizzle-orm": "^0.30.7",
|
|
||||||
"extract-zip": "^2.0.1",
|
|
||||||
"html-to-text": "^9.0.5",
|
|
||||||
"ioredis": "^5.3.2",
|
|
||||||
"ip-matching": "^2.1.2",
|
|
||||||
"iso-639-1": "^3.1.0",
|
|
||||||
"isomorphic-dompurify": "latest",
|
|
||||||
"jose": "^5.2.4",
|
|
||||||
"linkify-html": "^4.1.3",
|
|
||||||
"linkify-string": "^4.1.3",
|
|
||||||
"linkifyjs": "^4.1.3",
|
|
||||||
"log-manager": "workspace:*",
|
|
||||||
"magic-regexp": "^0.8.0",
|
|
||||||
"markdown-it": "^14.1.0",
|
|
||||||
"markdown-it-anchor": "^8.6.7",
|
|
||||||
"markdown-it-container": "^4.0.0",
|
|
||||||
"markdown-it-toc-done-right": "^4.2.0",
|
|
||||||
"media-manager": "workspace:*",
|
|
||||||
"megalodon": "^10.0.0",
|
|
||||||
"meilisearch": "^0.38.0",
|
|
||||||
"mime-types": "^2.1.35",
|
|
||||||
"oauth4webapi": "^2.4.0",
|
|
||||||
"pg": "^8.11.5",
|
|
||||||
"request-parser": "workspace:*",
|
|
||||||
"sharp": "^0.33.3",
|
|
||||||
"string-comparison": "^1.3.0",
|
|
||||||
"zod": "^3.22.4",
|
|
||||||
"zod-validation-error": "^3.2.0"
|
|
||||||
}
|
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,5 +1,5 @@
|
||||||
import { dualLogger } from "@loggers";
|
import { dualLogger } from "@loggers";
|
||||||
import { errorResponse, response } from "@response";
|
import { clientResponse, errorResponse, response } from "@response";
|
||||||
import type { MatchedRoute } from "bun";
|
import type { MatchedRoute } from "bun";
|
||||||
import type { Config } from "config-manager";
|
import type { Config } from "config-manager";
|
||||||
import { matches } from "ip-matching";
|
import { matches } from "ip-matching";
|
||||||
|
|
@ -215,6 +215,10 @@ export const createServer = (
|
||||||
);
|
);
|
||||||
}
|
}
|
||||||
|
|
||||||
return proxy;
|
return clientResponse(
|
||||||
|
await proxy.arrayBuffer(),
|
||||||
|
proxy.status,
|
||||||
|
proxy.headers.toJSON(),
|
||||||
|
);
|
||||||
},
|
},
|
||||||
});
|
});
|
||||||
|
|
|
||||||
|
|
@ -5,8 +5,10 @@ export const response = (
|
||||||
) => {
|
) => {
|
||||||
return new Response(data, {
|
return new Response(data, {
|
||||||
headers: {
|
headers: {
|
||||||
"Content-Type": "application/json",
|
|
||||||
"X-Frame-Options": "DENY",
|
"X-Frame-Options": "DENY",
|
||||||
|
"X-Content-Type-Options": "nosniff",
|
||||||
|
"Referrer-Policy": "no-referrer",
|
||||||
|
"Strict-Transport-Security": "max-age=3153600",
|
||||||
"X-Permitted-Cross-Domain-Policies": "none",
|
"X-Permitted-Cross-Domain-Policies": "none",
|
||||||
"Access-Control-Allow-Credentials": "true",
|
"Access-Control-Allow-Credentials": "true",
|
||||||
"Access-Control-Allow-Headers":
|
"Access-Control-Allow-Headers":
|
||||||
|
|
@ -15,7 +17,6 @@ export const response = (
|
||||||
"Access-Control-Allow-Origin": "*",
|
"Access-Control-Allow-Origin": "*",
|
||||||
"Access-Control-Expose-Headers":
|
"Access-Control-Expose-Headers":
|
||||||
"Link,X-RateLimit-Reset,X-RateLimit-Limit,X-RateLimit-Remaining,X-Request-Id,Idempotency-Key",
|
"Link,X-RateLimit-Reset,X-RateLimit-Limit,X-RateLimit-Remaining,X-Request-Id,Idempotency-Key",
|
||||||
// CSP should follow Content Security Policy directive: "connect-src 'self' blob: https: wss:".
|
|
||||||
"Content-Security-Policy":
|
"Content-Security-Policy":
|
||||||
"default-src 'none'; frame-ancestors 'none'; form-action 'none'",
|
"default-src 'none'; frame-ancestors 'none'; form-action 'none'",
|
||||||
...headers,
|
...headers,
|
||||||
|
|
@ -30,8 +31,10 @@ export const clientResponse = (
|
||||||
headers: Record<string, string> = {},
|
headers: Record<string, string> = {},
|
||||||
) => {
|
) => {
|
||||||
return response(data, status, {
|
return response(data, status, {
|
||||||
|
"Content-Security-Policy":
|
||||||
|
"Content-Security-Policy: default-src 'none'; script-src 'self'; style-src 'self'; img-src *; font-src 'self'; connect-src 'self'; media-src *; object-src 'none'; prefetch-src 'none'; child-src 'none'; frame-src 'none'; worker-src 'self'; frame-ancestors 'none'; form-action 'self'; upgrade-insecure-requests; block-all-mixed-content; base-uri 'self'; manifest-src 'self'",
|
||||||
|
"Access-Control-Allow-Origin": "null",
|
||||||
...headers,
|
...headers,
|
||||||
"Content-Security-Policy": "", //"default-src 'none'; frame-ancestors 'none'; form-action 'self'; connect-src 'self' blob: https: wss:; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'; object-src 'none'; media-src 'self'; frame-src 'none'; worker-src 'self'; manifest-src 'self'; prefetch-src 'self'; base-uri 'none';",
|
|
||||||
});
|
});
|
||||||
};
|
};
|
||||||
|
|
||||||
|
|
|
||||||
Loading…
Reference in a new issue