dylan.derr/Send
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

replaced fxa-geodb with load balancer header

Browse source 
Co-authored-by: timvisee <tim@visee.me>
This commit is contained in:
Danny Coates 2020-07-28 09:31:09 -07:00 • committed by timvisee
parent 4b1b7cb821
commit b5ef1785ab
No known key found for this signature in database
GPG key ID: B8DB720BC383E172
8 changed files with 84 additions and 141 deletions
Download patch file Download diff file Expand all files Collapse all files

104
server/routes/index.js
View file

@ -32,55 +32,54 @@ module.exports = function(app) {
});
if (!IS_DEV) {
let csp = {
directives: {
defaultSrc: ["'self'"],
connectSrc: [
"'self'",
'wss://*.dev.lcip.org',
'wss://*.send.nonprod.cloudops.mozgcp.net',
config.base_url.replace(/^https:\/\//, 'wss://'),
'https://*.dev.lcip.org',
'https://accounts.firefox.com',
'https://*.accounts.firefox.com',
'https://sentry.prod.mozaws.net'
],
imgSrc: [
"'self'",
'https://*.dev.lcip.org',
'https://firefoxusercontent.com',
'https://secure.gravatar.com'
],
scriptSrc: [
"'self'",
function(req) {
return `'nonce-${req.cspNonce}'`;
}
],
formAction: ["'none'"],
frameAncestors: ["'none'"],
objectSrc: ["'none'"],
reportUri: '/__cspreport__'
}
directives: {
defaultSrc: ["'self'"],
connectSrc: [
"'self'",
'wss://*.dev.lcip.org',
'wss://*.send.nonprod.cloudops.mozgcp.net',
config.base_url.replace(/^https:\/\//, 'wss://'),
'https://*.dev.lcip.org',
'https://accounts.firefox.com',
'https://*.accounts.firefox.com',
'https://sentry.prod.mozaws.net'
],
imgSrc: [
"'self'",
'https://*.dev.lcip.org',
'https://firefoxusercontent.com',
'https://secure.gravatar.com'
],
scriptSrc: [
"'self'",
function(req) {
return `'nonce-${req.cspNonce}'`;
}
],
formAction: ["'none'"],
frameAncestors: ["'none'"],
objectSrc: ["'none'"],
reportUri: '/__cspreport__'
}
};
csp.directives.connectSrc.push(config.base_url.replace(/^https:\/\//,'wss://'))
if(config.fxa_csp_oauth_url != ""){
csp.directives.connectSrc.push(config.fxa_csp_oauth_url)
}
if(config.fxa_csp_content_url != "" ){
csp.directives.connectSrc.push(config.fxa_csp_content_url)
}
if(config.fxa_csp_profile_url != "" ){
csp.directives.connectSrc.push(config.fxa_csp_profile_url)
}
if(config.fxa_csp_profileimage_url != ""){
csp.directives.imgSrc.push(config.fxa_csp_profileimage_url)
}
app.use(
helmet.contentSecurityPolicy(csp)
csp.directives.connectSrc.push(
config.base_url.replace(/^https:\/\//, 'wss://')
);
if (config.fxa_csp_oauth_url != '') {
csp.directives.connectSrc.push(config.fxa_csp_oauth_url);
}
if (config.fxa_csp_content_url != '') {
csp.directives.connectSrc.push(config.fxa_csp_content_url);
}
if (config.fxa_csp_profile_url != '') {
csp.directives.connectSrc.push(config.fxa_csp_profile_url);
}
if (config.fxa_csp_profileimage_url != '') {
csp.directives.imgSrc.push(config.fxa_csp_profileimage_url);
}
app.use(helmet.contentSecurityPolicy(csp));
}
app.use(function(req, res, next) {
@ -91,6 +90,19 @@ module.exports = function(app) {
);
next();
});
app.use(function(req, res, next) {
try {
// set by the load balancer
const [country, state] = req.header('X-Client-Geo-Location').split(',');
req.geo = {
country,
state
};
} catch (e) {
req.geo = {};
}
next();
});
app.use(bodyParser.json());
app.use(bodyParser.text());
app.get('/', language, pages.index);