usememos/memos
1
1
Fork 0
mirror of https://github.com/usememos/memos.git synced 2024-12-29 08:33:50 +08:00
Code Issues Projects Releases Packages Wiki Activity

fix: set csp header only for resource (#836)

Browse source
This commit is contained in:
boojack 2022-12-23 20:02:42 +08:00 committed by GitHub
parent 119603da5d
commit 99d9cc9168
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 1 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
server/resource.go
View file

@ -265,6 +265,7 @@ func (s *Server) registerResourcePublicRoutes(g *echo.Group) {
c.Response().Writer.Header().Set("Content-Type", resource.Type)
c.Response().Writer.WriteHeader(http.StatusOK)
c.Response().Writer.Header().Set(echo.HeaderCacheControl, "max-age=31536000, immutable")
c.Response().Writer.Header().Set(echo.HeaderContentSecurityPolicy, "default-src 'self'")
if _, err := c.Response().Writer.Write(resource.Blob); err != nil {
return echo.NewHTTPError(http.StatusInternalServerError, "Failed to write response").SetInternal(err)
}

4
server/server.go
View file

@ -44,10 +44,6 @@ func NewServer(profile *profile.Profile) *Server {
Timeout: 30 * time.Second,
}))
e.Use(middleware.SecureWithConfig(middleware.SecureConfig{
ContentSecurityPolicy: "default-src 'self'",
}))
embedFrontend(e)
// In dev mode, set the const secret key to make signin session persistence.