Documentation
¶
Overview ¶
Package web serves the embedded single-page app and sets security headers.
Index ¶
Constants ¶
const ContentSecurityPolicy = "default-src 'self'; " +
"script-src 'self'; " +
"style-src 'self' 'unsafe-inline'; " +
"img-src 'self' data: https:; " +
"font-src 'self' data:; " +
"connect-src 'self'%s; " +
"worker-src 'self' blob:; " +
"child-src 'self' blob:; " +
"object-src 'none'; " +
"base-uri 'self'; " +
"form-action 'self'; " +
"frame-ancestors 'none'"
ContentSecurityPolicy is applied to every response. Scripts must come from our origin only; inline styles are allowed because Radix/sonner set them at runtime. Avatars may be loaded from IdPs over https. Workers may be spawned from self or blob: URLs (e.g. browser extensions, client background jobs). connect-src is completed per request (see SecurityHeaders): same-origin WebSockets for the web client, plus configured hbbs/hbbr WebSocket origins.
Variables ¶
This section is empty.
Functions ¶
func SecurityHeaders ¶
SecurityHeaders sets defensive headers on every response. HSTS is only sent when the panel is served over https (public URL scheme). wsOrigins are extra WebSocket origins the web client may connect to.
Types ¶
type SPA ¶
type SPA struct {
// contains filtered or unexported fields
}
SPA serves static files from fsys with an index.html fallback for client routes. Hashed assets under /assets/ are cached immutably; index.html is never cached so deployments take effect immediately.
Source Files