Commit
Send HSTS when served over TLS, patch transitive dependency advisories
commit
4b66fa5
2 changed files with +16 and −10
Jump to a changed file
- package-lock.json +10 −10
- src/app.js +6 −0
modified package-lock.json +10 −10
| @@ -1070,9 +1070,9 @@ | ||
| 1070 | 1070 | } |
| 1071 | 1071 | }, |
| 1072 | 1072 | "node_modules/brace-expansion": { |
| 1073 | - "version": "2.1.2", | |
| 1074 | - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.2.tgz", | |
| 1075 | - "integrity": "sha512-w5JZcKgdhDOgOwm8H+KgbosopHMuGcl6qbulwjtz3SM7I7P3yW1eAjzMPLrIE+NQ9vjgANKHWeMHnrT0OXW1oA==", | |
| 1073 | + "version": "2.1.4", | |
| 1074 | + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.4.tgz", | |
| 1075 | + "integrity": "sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==", | |
| 1076 | 1076 | "license": "MIT", |
| 1077 | 1077 | "dependencies": { |
| 1078 | 1078 | "balanced-match": "^1.0.0" |
| @@ -2094,9 +2094,9 @@ | ||
| 2094 | 2094 | "license": "MIT" |
| 2095 | 2095 | }, |
| 2096 | 2096 | "node_modules/nanoid": { |
| 2097 | - "version": "3.3.16", | |
| 2098 | - "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.16.tgz", | |
| 2099 | - "integrity": "sha512-bzlKTyNJ7+LdGIIwy8ijFpIqEQIvafahV7eYykJ8Cvh42EdJeODoJ6gUJXpQJvej1BddH8OqTXZNE/KfbWAu8Q==", | |
| 2097 | + "version": "3.3.18", | |
| 2098 | + "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.18.tgz", | |
| 2099 | + "integrity": "sha512-DTg4MJbGMWkfi6VZFdNt2/caMbQy4Ou+Op/hJQvGEWcnVfoA1QA+xzRKAzw9jD6+GVOOeYr/mIcuDSdug6F6+w==", | |
| 2100 | 2100 | "funding": [ |
| 2101 | 2101 | { |
| 2102 | 2102 | "type": "github", |
| @@ -2215,9 +2215,9 @@ | ||
| 2215 | 2215 | } |
| 2216 | 2216 | }, |
| 2217 | 2217 | "node_modules/postcss": { |
| 2218 | - "version": "8.5.22", | |
| 2219 | - "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.22.tgz", | |
| 2220 | - "integrity": "sha512-KBDEIpLrvpv16pp3K0Fw+UCoZfopFjjgeB+0tA/aaThfEE74kKDLrgg603YvOWJyg3+WYtyq3xYsQWsIyZlPqQ==", | |
| 2218 | + "version": "8.5.26", | |
| 2219 | + "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.26.tgz", | |
| 2220 | + "integrity": "sha512-u82N74LFzG8ca+dD8puPnplTXoGH4fTPpVGuIbt36G3qvNlkvfD0lEAZSxaly3KX8TS/L1A1gsCEmvKmBcVbkQ==", | |
| 2221 | 2221 | "funding": [ |
| 2222 | 2222 | { |
| 2223 | 2223 | "type": "opencollective", |
| @@ -2234,7 +2234,7 @@ | ||
| 2234 | 2234 | ], |
| 2235 | 2235 | "license": "MIT", |
| 2236 | 2236 | "dependencies": { |
| 2237 | - "nanoid": "^3.3.16", | |
| 2237 | + "nanoid": "^3.3.17", | |
| 2238 | 2238 | "picocolors": "^1.1.1", |
| 2239 | 2239 | "source-map-js": "^1.2.1" |
| 2240 | 2240 | }, |
modified src/app.js +6 −0
| @@ -264,12 +264,18 @@export function createApp({ config, store, github, now = () => new Date() }) { | ||
| 264 | 264 | }); |
| 265 | 265 | }; |
| 266 | 266 | app.use(express.urlencoded({ extended: false, limit: "100kb" })); |
| 267 | + // Only sent when the app is actually served over TLS. Setting HSTS from a | |
| 268 | + // plain-HTTP dev origin would pin localhost to https for two years, which is | |
| 269 | + // a genuinely annoying thing to do to your own machine. | |
| 270 | + const overTls = config.baseUrl.startsWith("https://"); | |
| 271 | + | |
| 267 | 272 | app.use((req, res, next) => { |
| 268 | 273 | res.set({ |
| 269 | 274 | "Content-Security-Policy": "default-src 'self'; img-src 'self' https: data:; style-src 'self'; script-src 'self'; base-uri 'none'; form-action 'self'; frame-ancestors 'none'", |
| 270 | 275 | "Referrer-Policy": "no-referrer", |
| 271 | 276 | "X-Content-Type-Options": "nosniff", |
| 272 | 277 | "X-Frame-Options": "DENY", |
| 278 | + ...(overTls ? { "Strict-Transport-Security": "max-age=31536000" } : {}), | |
| 273 | 279 | }); |
| 274 | 280 | next(); |
| 275 | 281 | }); |