web

package

v0.10.6 Latest Latest Go to latest Published: Oct 20, 2026 License: MIT Imports: 7 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/bropines/rdpanel

Links

Open Source Insights

Documentation ¶

Overview ¶

Package web serves the embedded single-page app and sets security headers.

Index ¶

Constants
func SecurityHeaders(hsts bool) func(http.Handler) http.Handler
type SPA
- func NewSPA(fsys fs.FS) *SPA
- func (s *SPA) Built() bool
- func (s *SPA) ServeHTTP(w http.ResponseWriter, r *http.Request)

Constants ¶

View Source

const ContentSecurityPolicy = "default-src 'self'; " +
	"script-src 'self'; " +
	"style-src 'self' 'unsafe-inline'; " +
	"img-src 'self' data: https:; " +
	"font-src 'self' data:; " +
	"connect-src 'self' ws: wss:; " +
	"worker-src 'self' blob:; " +
	"child-src 'self' blob:; " +
	"object-src 'none'; " +
	"base-uri 'self'; " +
	"form-action 'self'; " +
	"frame-ancestors 'none'"

ContentSecurityPolicy is applied to every response. Scripts must come from our origin only; inline styles are allowed because Radix/sonner set them at runtime. Avatars may be loaded from IdPs over https. Workers may be spawned from self or blob: URLs (e.g. browser extensions, client background jobs).

Variables ¶

This section is empty.

Functions ¶

func SecurityHeaders ¶

func SecurityHeaders(hsts bool) func(http.Handler) http.Handler

SecurityHeaders sets defensive headers on every response. HSTS is only sent when the panel is served over https (public URL scheme).

Types ¶

type SPA ¶

type SPA struct {
	// contains filtered or unexported fields
}

SPA serves static files from fsys with an index.html fallback for client routes. Hashed assets under /assets/ are cached immutably; index.html is never cached so deployments take effect immediately.

func NewSPA ¶

func NewSPA(fsys fs.FS) *SPA

NewSPA builds the handler. When fsys has no index.html (UI not built), a placeholder page is served instead.

func (*SPA) Built ¶

func (s *SPA) Built() bool

Built reports whether a real UI build is embedded.

func (*SPA) ServeHTTP ¶

func (s *SPA) ServeHTTP(w http.ResponseWriter, r *http.Request)

ServeHTTP implements http.Handler.

Source Files ¶

View all Source files

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL