misskey-dev/media-proxy
1
0
Fork 0
mirror of https://github.com/misskey-dev/media-proxy.git synced 2025-04-29 02:47:26 +09:00
Code Issues Packages Projects Releases Wiki Activity

Add CORS and CSP setting

Browse Source 
Resolve #5
This commit is contained in:
tamaina 2023-02-20 14:45:15 +00:00
parent ea5af77e6e
commit 2679ec2b28
4 changed files with 21 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
README.md
View File

@ -60,6 +60,13 @@ export default {
// ダウンロードするファイルの最大サイズ (bytes) // ダウンロードするファイルの最大サイズ (bytes)
maxSize: 262144000, maxSize: 262144000,
// CORS
['Access-Control-Allow-Origin']: '*',
['Access-Control-Allow-Headers']: '*',
// CSP
['Content-Security-Policy']: `default-src 'none'; img-src 'self'; media-src 'self'; style-src 'unsafe-inline'`,
// フォワードプロキシ // フォワードプロキシ
// proxy: 'http://127.0.0.1:3128' // proxy: 'http://127.0.0.1:3128'
} }

3
built/index.d.ts vendored
View File

@ -4,6 +4,9 @@ import * as http from 'node:http';
import * as https from 'node:https'; import * as https from 'node:https';
import type { FastifyInstance } from 'fastify'; import type { FastifyInstance } from 'fastify';
export type MediaProxyOptions = { export type MediaProxyOptions = {
['Access-Control-Allow-Origin']?: string;
['Access-Control-Allow-Headers']?: string;
['Content-Security-Policy']?: string;
userAgent?: string; userAgent?: string;
allowedPrivateNetworks?: string[]; allowedPrivateNetworks?: string[];
maxSize?: number; maxSize?: number;

5
built/index.js
View File

@ -42,7 +42,10 @@ export function setMediaProxyConfig(setting) {
export default function (fastify, options, done) { export default function (fastify, options, done) {
setMediaProxyConfig(options); setMediaProxyConfig(options);
fastify.addHook('onRequest', (request, reply, done) => { fastify.addHook('onRequest', (request, reply, done) => {
reply.header('Content-Security-Policy', `default-src 'none'; img-src 'self'; media-src 'self'; style-src 'unsafe-inline'`); reply.header('Access-Control-Allow-Origin', options['Access-Control-Allow-Origin'] ?? '*');
reply.header('Access-Control-Allow-Headers', options['Access-Control-Allow-Headers'] ?? '*');
reply.header('Access-Control-Allow-Methods', 'GET, OPTIONS');
reply.header('Content-Security-Policy', options['Content-Security-Policy'] ?? `default-src 'none'; img-src 'self'; media-src 'self'; style-src 'unsafe-inline'`);
done(); done();
}); });
fastify.register(fastifyStatic, { fastify.register(fastifyStatic, {

8
src/index.ts
View File

@ -20,6 +20,9 @@ const _dirname = dirname(_filename);
const assets = `${_dirname}/../../server/file/assets/`; const assets = `${_dirname}/../../server/file/assets/`;
export type MediaProxyOptions = { export type MediaProxyOptions = {
['Access-Control-Allow-Origin']?: string;
['Access-Control-Allow-Headers']?: string;
['Content-Security-Policy']?: string;
userAgent?: string; userAgent?: string;
allowedPrivateNetworks?: string[]; allowedPrivateNetworks?: string[];
maxSize?: number; maxSize?: number;
@ -66,7 +69,10 @@ export default function (fastify: FastifyInstance, options: MediaProxyOptions |
setMediaProxyConfig(options); setMediaProxyConfig(options);
fastify.addHook('onRequest', (request, reply, done) => { fastify.addHook('onRequest', (request, reply, done) => {
reply.header('Content-Security-Policy', `default-src 'none'; img-src 'self'; media-src 'self'; style-src 'unsafe-inline'`); reply.header('Access-Control-Allow-Origin', options!['Access-Control-Allow-Origin'] ?? '*');
reply.header('Access-Control-Allow-Headers', options!['Access-Control-Allow-Headers'] ?? '*');
reply.header('Access-Control-Allow-Methods', 'GET, OPTIONS');
reply.header('Content-Security-Policy', options!['Content-Security-Policy'] ?? `default-src 'none'; img-src 'self'; media-src 'self'; style-src 'unsafe-inline'`);
done(); done();
}); });