Documentation
¶
Overview ¶
Package web serves the embedded single-page app and sets security headers.
Index ¶
Constants ¶
const ContentSecurityPolicy = "default-src 'self'; " +
"script-src 'self'; " +
"style-src 'self' 'unsafe-inline'; " +
"img-src 'self' data: https:; " +
"font-src 'self' data:; " +
"connect-src 'self'%s; " +
"worker-src 'self' blob:; " +
"child-src 'self' blob:; " +
"object-src 'none'; " +
"base-uri 'self'; " +
"form-action 'self'; " +
"frame-ancestors 'none'"
ContentSecurityPolicy is applied to every response. Scripts must come from our origin only; inline styles are allowed because Radix/sonner set them at runtime. Avatars may be loaded from IdPs over https. Workers may be spawned from self or blob: URLs (e.g. browser extensions, client background jobs). connect-src is completed per request (see SecurityHeaders): same-origin WebSockets for the web client, plus configured hbbs/hbbr WebSocket origins.
Variables ¶
This section is empty.
Functions ¶
func SecurityHeaders ¶
SecurityHeaders sets defensive headers on every response. HSTS is only sent when the panel is served over https (public URL scheme).
Types ¶
type ConnectSources ¶ added in v0.12.0
type ConnectSources struct {
// Origins are WebSocket URLs (only their ws(s)://host[:port] is used).
Origins []string
// AnyWSS allows every wss: origin (users may enter their own servers).
AnyWSS bool
}
ConnectSources are the extra places the web client may open WebSockets to.
type SPA ¶
type SPA struct {
// contains filtered or unexported fields
}
SPA serves static files from fsys with an index.html fallback for client routes. Hashed assets under /assets/ are cached immutably; index.html is never cached so deployments take effect immediately.
Source Files