34 lines
1.1 KiB
TypeScript
34 lines
1.1 KiB
TypeScript
import type { MiddlewareHandler } from 'hono';
|
|
import { cors as honoCors } from 'hono/cors';
|
|
|
|
function getWebOrigin(): string {
|
|
return process.env.WEB_URL ?? 'http://localhost:6173';
|
|
}
|
|
|
|
export const corsMiddleware: MiddlewareHandler = honoCors({
|
|
origin: (requestOrigin) => {
|
|
const allowed = getWebOrigin();
|
|
if (requestOrigin === allowed) {
|
|
return requestOrigin;
|
|
}
|
|
return '';
|
|
},
|
|
allowMethods: ['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'OPTIONS'],
|
|
allowHeaders: ['Content-Type', 'Authorization', 'Cache-Control'],
|
|
maxAge: 600,
|
|
credentials: true,
|
|
});
|
|
|
|
export const securityHeadersMiddleware: MiddlewareHandler = async (c, next) => {
|
|
await next();
|
|
|
|
c.header('X-Content-Type-Options', 'nosniff');
|
|
c.header('X-Frame-Options', 'DENY');
|
|
c.header('X-XSS-Protection', '0');
|
|
c.header('Referrer-Policy', 'strict-origin-when-cross-origin');
|
|
c.header('Permissions-Policy', 'camera=(), microphone=(), geolocation=()');
|
|
|
|
if (process.env.NODE_ENV === 'production') {
|
|
c.header('Strict-Transport-Security', 'max-age=31536000; includeSubDomains');
|
|
}
|
|
}; |