add ability to specify CSP, Content-Security-Policy

[komuw]

ong/middleware/security.go

Lines 56 to 74 in 0760665

	nonce := id.Random(cspBytesTokenLength)
	r = r.WithContext(context.WithValue(ctx, cspCtxKey, nonce))
	w.Header().Set(
	cspHeader,
	// - https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP
	// - https://web.dev/security-headers/
	// - https://stackoverflow.com/a/66955464/2768067
	// - https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/script-src
	// - https://web.dev/security-headers/#tt
	// - https://securityheaders.com/
	//
	// content is only permitted from:
	// - the document's origin(and subdomains)
	// - images may load from anywhere
	// - media is allowed from domain(and its subdomains)
	// - executable scripts is only allowed from self(& subdomains).
	// - DOM xss(eg setting innerHtml) is blocked by require-trusted-types.
	getCsp(domain, nonce),
	)

[komuw]

ong/middleware/csp.go

Lines 70 to 74 in f2c39ac

	// - media is allowed from domain(and its subdomains)
	// - executable scripts is only allowed from self(& subdomains).
	// - DOM xss(eg setting innerHtml) is blocked by require-trusted-types.
	getCsp(domain, nonce),
	)

[komuw]

If we do this, maybe we should also be able to configure the headers;

ong/middleware/csp.go

Lines 70 to 109 in f2c39ac

	// - media is allowed from domain(and its subdomains)
	// - executable scripts is only allowed from self(& subdomains).
	// - DOM xss(eg setting innerHtml) is blocked by require-trusted-types.
	getCsp(domain, nonce),
	)
	w.Header().Set(
	xContentOptionsHeader,
	"nosniff",
	)
	w.Header().Set(
	xFrameHeader,
	"DENY",
	)
	w.Header().Set(
	corpHeader,
	"same-site",
	)
	w.Header().Set(
	coopHeader,
	"same-origin",
	)
	w.Header().Set(
	referrerHeader,
	// - https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy
	"strict-origin-when-cross-origin",
	)
	if r.TLS != nil {
	w.Header().Set(
	stsHeader,
	// - https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security
	// A max-age(in seconds) of 2yrs is recommended
	getSts(60*24*time.Hour), // 60 days
	)
	}

[komuw]

https://observatory.mozilla.org/analyze/dushed.com