feat: add CSP and other security related headers in the oCIS proxy service (#8777)

* feat: add CSP and other security related headers in the oCIS proxy service

* fix: consolidate security related headers - drop middleware.Secure

* fix: use github.com/DeepDiver1975/secure

* fix: acceptance tests

* feat: support env var replacements in csp.yaml
This commit is contained in:
Thomas Müller
2024-04-26 09:10:35 +02:00
committed by GitHub
parent d3415a8c92
commit bdbba929d0
47 changed files with 2357 additions and 36 deletions
@@ -52,7 +52,6 @@ func Server(opts ...Option) (ohttp.Service, error) {
cors.AllowedHeaders(options.Config.HTTP.CORS.AllowedHeaders),
cors.AllowCredentials(options.Config.HTTP.CORS.AllowCredentials),
))
mux.Use(middleware.Secure)
mux.Use(middleware.ExtractAccountUUID(
account.Logger(options.Logger),
account.JWTSecret(options.Config.TokenManager.JWTSecret)),