mirrors/tailscale
1
0
Fork 0
Code Issues Pull Requests Projects Wiki Activity

client/web: use CSP hash for inline javascript

Browse Source 
Calculate and set the hash of the one inline script we have in
index.html. That script is unlikely to change, so hardcoding the hash
seems fine for now.

Updates #10261
Updates tailscale/corp#16266

Signed-off-by: Will Norris <will@tailscale.com>
This commit is contained in:
Will Norris
2023-12-11 19:33:38 -08:00
committed by Will Norris
parent bc9b9e8f69
commit d2fbdb005d
2 changed files with 9 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
client/web/web.go
View File

@ -251,9 +251,13 @@ func (s *Server) serve(w http.ResponseWriter, r *http.Request) {
}
if !s.devMode {
// This hash corresponds to the inline script in index.html that runs when the react app is unavailable.
// It was generated from https://csplite.com/csp/sha/.
// If the contents of the script are changed, this hash must be updated.
const indexScriptHash = "sha384-CW2AYVfS14P7QHZN27thEkMLKiCj3YNURPoLc1elwiEkMVHeuYTWkJOEki1F3nZc"
w.Header().Set("X-Frame-Options", "DENY")
// TODO: use CSP nonce or hash to eliminate need for unsafe-inline
w.Header().Set("Content-Security-Policy", "default-src 'self'; img-src * data:")
w.Header().Set("Content-Security-Policy", "default-src 'self'; img-src * data:; script-src 'self' '"+indexScriptHash+"'")
w.Header().Set("Cross-Origin-Resource-Policy", "same-origin")
}
}