GO-2025-3648: Steve doesn’t verify a server’s certificate and is susceptible to man-in-the-middle (MitM) attacks in github.com/rancher/stev

ui

package

v0.10.7 Latest Latest Go to latest Published: Oct 1, 2026 License: Apache-2.0 Imports: 9 Imported by: 1

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/rancher/steve

Links

Documentation ¶

Index ¶

Constants
func CSP(policy StringSetting) func(http.Handler) http.Handler
func New(path string) http.Handler
type BoolSetting
type Handler
- func NewUIHandler(opts *Options) *Handler
type Options
type StringSetting

Constants ¶

View Source

const DefaultCSPPolicy = "base-uri 'self'; object-src 'none'; frame-ancestors 'self'"

DefaultCSPPolicy is the Content-Security-Policy served with the UI when none is configured.

Variables ¶

This section is empty.

Functions ¶

func CSP ¶ added in v0.10.7

func CSP(policy StringSetting) func(http.Handler) http.Handler

CSP serves the configured Content-Security-Policy. An empty policy sends no header.

func New ¶

func New(path string) http.Handler

Types ¶

type BoolSetting ¶

type BoolSetting func() bool

type Handler ¶

type Handler struct {
	// contains filtered or unexported fields
}

func NewUIHandler ¶

func NewUIHandler(opts *Options) *Handler

func (*Handler) IndexFile ¶

func (u *Handler) IndexFile() http.Handler

func (*Handler) IndexFileOnNotFound ¶

func (u *Handler) IndexFileOnNotFound() http.Handler

func (*Handler) ServeAPIUI ¶ added in v0.7.16

func (u *Handler) ServeAPIUI() http.Handler

func (*Handler) ServeAsset ¶

func (u *Handler) ServeAsset() http.Handler

func (*Handler) ServeFaviconDashboard ¶

func (u *Handler) ServeFaviconDashboard() http.Handler

type Options ¶

type Options struct {
	// The location on disk of the UI files
	Path StringSetting
	// The HTTP URL of the index file to download
	Index StringSetting
	// Whether or not to run the UI offline, should return true/false/dynamic
	Offline StringSetting
	// Whether or not is it release, if true UI will run offline if set to dynamic
	ReleaseSetting BoolSetting
	// The version of API UI to use
	APIUIVersionSetting StringSetting
	// The Content-Security-Policy to serve the UI with
	CSPPolicy StringSetting
}

type StringSetting ¶

type StringSetting func() string

Source Files ¶

View all Source files

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL