mirrors/prosody
1
0
Fork 0
mirror of https://github.com/bjc/prosody.git synced 2025-04-03 21:27:38 +03:00
Code Issues Projects Releases Packages Wiki Activity Actions

mod_http_file_share: More security headers

Browse source
This commit is contained in:
Kim Alvefur 2021-01-27 19:51:36 +01:00
parent 2cb87c6ffa
commit af9f7de378
1 changed files with 4 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

6
plugins/mod_http_file_share.lua
View file

@ -248,10 +248,12 @@ function handle_download(event, path) -- GET /uploads/:slot+filename
response.headers.cache_control = "max-age=31556952, immutable";
response.headers.content_security_policy = "default-src 'none'; frame-ancestors 'none';"
response.headers.strict_transport_security = "max-age=31556952";
response.headers.x_content_type_options = "nosniff";
response.headers.x_frame_options = "DENY"; -- replaced by frame-ancestors in CSP?
response.headers.x_xss_protection = "1; mode=block";
return response:send_file(handle);
-- TODO
-- Set security headers
end
-- TODO periodic cleanup job