robbond/pedwfrontend
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merged PR 738: Updated csp and headers

Browse Source 
Updated csp and headers

Related work items: #7220
This commit is contained in:
Robert Bond
2022-01-18 14:00:42 +00:00
parent 674dcef43e 5af7b78a44
commit 55e27a0dfd
5 changed files with 54 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
components/homepage/login.js
+10 -10
View File
@@ -124,16 +124,16 @@ let Login = (props) => {
// const [showSpinnerState, setShowSpinnerState] = useState(false); // const [showSpinnerState, setShowSpinnerState] = useState(false);
const [validLoginID, setValidLoginID] = useState(null); const [validLoginID, setValidLoginID] = useState(null);
console.log( // console.log(
"built login url path:", // "built login url path:",
props.govGateway.config.authorization_endpoint + // props.govGateway.config.authorization_endpoint +
"?response_type=code&scope=openid&client_id=" + // "?response_type=code&scope=openid&client_id=" +
GG_CLIENT_ID + // GG_CLIENT_ID +
"&redirect_uri=" + // "&redirect_uri=" +
GG_REDIRECT_URI + // GG_REDIRECT_URI +
"&ui_locales=" + // "&ui_locales=" +
(router.locale == "cy" ? "cy" : "en-GB") // (router.locale == "cy" ? "cy" : "en-GB")
); // );
// let spinnerState = () => { // let spinnerState = () => {
// showSpinnerState == true // showSpinnerState == true
components/tracking/index.js
+2 -1
View File
@@ -1,8 +1,9 @@
import React, { Fragment } from "react"; import React, { Fragment } from "react";
export const Tracking = ({ googleTagManagerID }) => ( export const Tracking = ({ googleTagManagerID, nonce }) => (
<Fragment> <Fragment>
<script <script
nonce={nonce}
dangerouslySetInnerHTML={{ dangerouslySetInnerHTML={{
__html: `(function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start': __html: `(function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':
new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0], new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],
next.config.js
+18 -2
View File
@@ -27,14 +27,30 @@ const securityHeaders = [
key: "X-Frame-Options", key: "X-Frame-Options",
value: "SAMEORIGIN", value: "SAMEORIGIN",
}, },
{
key: "X-Content-Type-Options",
value: "nosniff",
},
{
key: "X-Permitted-Cross-Domain-Policies",
value: "none",
},
{
key: "Referrer-Policy",
value: "origin-when-cross-origin", //no-referrer
},
{ {
key: "Strict-Transport-Security", key: "Strict-Transport-Security",
value: "max-age=63072000; includeSubDomains; preload", value: "max-age=63072000; includeSubDomains; preload",
}, },
{ {
key: "Content-Security-Policy", key: "X-XSS-Protection",
value: "frame-src 'self'; child-src 'self'", value: "1; mode=block",
}, },
// {
// key: "Content-Security-Policy",
// value: "frame-src 'self'; child-src 'self';object-src 'none'; script-src 'self' 'https://www.googletagmanager.com' unsafe-inline",
// },
]; ];
module.exports = { module.exports = {
package.json
+1
View File
@@ -27,6 +27,7 @@
"jsonpath-plus": "^6.0.1", "jsonpath-plus": "^6.0.1",
"lodash": "^4.17.21", "lodash": "^4.17.21",
"moment": "^2.29.1", "moment": "^2.29.1",
"nanoid": "^3.2.0",
"next": "^12.0.8", "next": "^12.0.8",
"next-redux-wrapper": "^7.0.5", "next-redux-wrapper": "^7.0.5",
"next-translate": "^1.2.0", "next-translate": "^1.2.0",
pages/_document.js
+22 -3
View File
@@ -2,6 +2,7 @@ import Document, { Html, Head, Main, NextScript } from "next/document";
import SkipLink from "../components/skiplink"; import SkipLink from "../components/skiplink";
import { Tracking, TrackingNoScript } from "../components/tracking"; import { Tracking, TrackingNoScript } from "../components/tracking";
import basicAuthMiddleware from "nextjs-basic-auth-middleware"; import basicAuthMiddleware from "nextjs-basic-auth-middleware";
import { nanoid } from "nanoid";
class MyDocument extends Document { class MyDocument extends Document {
static async getInitialProps(ctx) { static async getInitialProps(ctx) {
@@ -38,26 +39,44 @@ class MyDocument extends Document {
render() { render() {
const googleTagManagerID = process.env.GOOGLE_TAG_MANAGER || null; const googleTagManagerID = process.env.GOOGLE_TAG_MANAGER || null;
const { useGATracking } = this.props; const { useGATracking } = this.props;
const generatedNonce = nanoid();
let csp = ``;
csp += `base-uri 'self';`;
csp += `form-action 'self';`;
csp += `object-src 'none';`;
csp += `script-src 'self' https://www.googletagmanager.com 'nonce-${generatedNonce}' ${
process.env.NODE_ENV != "production" ? " 'unsafe-eval';" : " ;"
}`;
csp += `img-src 'self' https://www.googletagmanager.com https://gov.wales https://www.google-analytics.com 'nonce-${generatedNonce}' data:;`;
csp += `style-src 'self' https://fonts.googleapis.com 'unsafe-inline' data:;`;
return ( return (
<Html lang="en"> <Html lang="en">
<Head> <Head>
<meta httpEquiv="Content-Security-Policy" content={csp} />
{useGATracking && ( {useGATracking && (
<Tracking googleTagManagerID={googleTagManagerID} /> <Tracking
googleTagManagerID={googleTagManagerID}
nonce={generatedNonce}
/>
)} )}
</Head> </Head>
<body className="js-enabled"> <body className="js-enabled">
{useGATracking && ( {useGATracking && (
<TrackingNoScript <TrackingNoScript
nonce={generatedNonce}
googleTagManagerID={googleTagManagerID} googleTagManagerID={googleTagManagerID}
/> />
)} )}
{!process.browser && ( {!process.browser && (
<> <>
<script> <script nonce={generatedNonce}>
window.switchDomain = `{process.env.I18N_DOMAIN} window.switchDomain = `{process.env.I18N_DOMAIN}
` `
</script> </script>
<script> <script nonce={generatedNonce}>
window.apiRoot = `{process.env.API_ROOT}` window.apiRoot = `{process.env.API_ROOT}`
</script> </script>
</> </>