1 # Pleroma: A lightweight social networking server
2 # Copyright © 2017-2019 Pleroma Authors <https://pleroma.social/>
3 # SPDX-License-Identifier: AGPL-3.0-only
5 defmodule Pleroma.Plugs.HTTPSecurityPlug do
11 def init(opts), do: opts
13 def call(conn, _options) do
14 if Config.get([:http_security, :enabled]) do
16 |> merge_resp_headers(headers())
17 |> maybe_send_sts_header(Config.get([:http_security, :sts]))
24 referrer_policy = Config.get([:http_security, :referrer_policy])
25 report_uri = Config.get([:http_security, :report_uri])
28 {"x-xss-protection", "1; mode=block"},
29 {"x-permitted-cross-domain-policies", "none"},
30 {"x-frame-options", "DENY"},
31 {"x-content-type-options", "nosniff"},
32 {"referrer-policy", referrer_policy},
33 {"x-download-options", "noopen"},
34 {"content-security-policy", csp_string() <> ";"}
39 "group" => "csp-endpoint",
40 "max-age" => 10_886_400,
42 %{"url" => report_uri}
46 headers ++ [{"reply-to", Jason.encode!(report_group)}]
53 scheme = Config.get([Pleroma.Web.Endpoint, :url])[:scheme]
54 static_url = Pleroma.Web.Endpoint.static_url()
55 websocket_url = Pleroma.Web.Endpoint.websocket_url()
56 report_uri = Config.get([:http_security, :report_uri])
58 connect_src = "connect-src 'self' #{static_url} #{websocket_url}"
61 if Pleroma.Config.get(:env) == :dev do
62 connect_src <> " http://localhost:3035/"
68 if Pleroma.Config.get(:env) == :dev do
69 "script-src 'self' 'unsafe-eval'"
77 "frame-ancestors 'none'",
78 "img-src 'self' data: https:",
79 "media-src 'self' https:",
80 "style-src 'self' 'unsafe-inline'",
82 "manifest-src 'self'",
87 report = if report_uri, do: ["report-uri #{report_uri}; report-to csp-endpoint"], else: []
89 insecure = if scheme == "https", do: ["upgrade-insecure-requests"], else: []
91 (main_part ++ report ++ insecure)
95 def warn_if_disabled do
96 unless Config.get([:http_security, :enabled]) do
97 Logger.warn("HTTP Security is disabled. Add this line to you config to enable it:
99 config :pleroma, :http_security, enabled: true
104 defp maybe_send_sts_header(conn, true) do
105 max_age_sts = Config.get([:http_security, :sts_max_age])
106 max_age_ct = Config.get([:http_security, :ct_max_age])
108 merge_resp_headers(conn, [
109 {"strict-transport-security", "max-age=#{max_age_sts}; includeSubDomains"},
110 {"expect-ct", "enforce, max-age=#{max_age_ct}"}
114 defp maybe_send_sts_header(conn, _), do: conn