diff --git a/api.go b/api.go
index e93c88fd..d7a1b7da 100644
--- a/api.go
+++ b/api.go
@@ -477,31 +477,38 @@ func NewAPI(config Config, a Adapter) API {
openAPIPath = path.Join(prefix, openAPIPath)
}
ctx.SetHeader("Content-Type", "text/html")
+ // Very strict CSP so we never expose any data to the outside world
+ csp := []string{
+ "default-src 'none'",
+ "base-uri 'none'",
+ "connect-src 'self'",
+ "form-action 'none'",
+ "frame-ancestors 'none'",
+ "sandbox allow-same-origin allow-scripts",
+ "script-src https://unpkg.com/",
+ "style-src 'unsafe-inline' https://unpkg.com/",
+ }
+ ctx.SetHeader("Content-Security-Policy", strings.Join(csp, "; "))
title := "Elements in HTML"
if config.Info != nil && config.Info.Title != "" {
title = config.Info.Title + " Reference"
}
- ctx.BodyWriter().Write([]byte(`
+ ctx.BodyWriter().Write([]byte(`
` + title + `
-
-
-
+
+
-
-
`))
})
diff --git a/docs/docs/features/api-docs.md b/docs/docs/features/api-docs.md
index baca3402..b09788f2 100644
--- a/docs/docs/features/api-docs.md
+++ b/docs/docs/features/api-docs.md
@@ -31,24 +31,32 @@ api := humachi.New(router, config)
router.Get("/docs", func(w http.ResponseWriter, r *http.Request) {
w.Header().Set("Content-Type", "text/html")
- w.Write([]byte(`
+ // Very strict CSP so we never expose any data to the outside world
+ csp := []string{
+ "default-src 'none'",
+ "base-uri 'none'",
+ "connect-src 'self'",
+ "form-action 'none'",
+ "frame-ancestors 'none'",
+ "sandbox allow-same-origin allow-scripts",
+ "script-src https://unpkg.com/",
+ "style-src 'unsafe-inline' https://unpkg.com/",
+ }
+ w.Header().Set("Content-Security-Policy", strings.Join(csp, "; "))
+ w.Write([]byte(`
-
+
Docs Example reference
-
-
-
+
+
@@ -71,20 +79,31 @@ api := humachi.New(router, config)
router.Get("/docs", func(w http.ResponseWriter, r *http.Request) {
w.Header().Set("Content-Type", "text/html")
- w.Write([]byte(`
-
+ // Very strict CSP so we never expose any data to the outside world
+ csp := []string{
+ "default-src 'none'",
+ "base-uri 'none'",
+ "connect-src 'self'",
+ "form-action 'none'",
+ "frame-ancestors 'none'",
+ "sandbox allow-same-origin allow-scripts",
+ "script-src 'unsafe-eval' https://unpkg.com/", // TODO: Somehow drop 'unsafe-eval'
+ "style-src 'unsafe-inline' https://unpkg.com/", // TODO: Somehow drop 'unsafe-inline'
+ }
+ w.Header().Set("Content-Security-Policy", strings.Join(csp, "; "))
+ w.Write([]byte(`
+
- API Reference
-
+
+
+ API Reference
-
+
`))
})
@@ -105,27 +124,39 @@ api := humachi.New(router, config)
router.Get("/docs", func(w http.ResponseWriter, r *http.Request) {
w.Header().Set("Content-Type", "text/html")
+ // Very strict CSP so we never expose any data to the outside world
+ csp := []string{
+ "default-src 'none'",
+ "base-uri 'none'",
+ "connect-src 'self'",
+ "form-action 'none'",
+ "frame-ancestors 'none'",
+ "sandbox allow-same-origin allow-scripts",
+ "script-src https://unpkg.com/ 'sha256-pyvxInx2c2C9E/dNMA9dfGa9z3Lhk9YDz1ET62LbfZs='",
+ "style-src https://unpkg.com/",
+ }
+ w.Header().Set("Content-Security-Policy", strings.Join(csp, "; "))
w.Write([]byte(`
-
-
-
-
- SwaggerUI
-
-
-
-
-
-
-
+
+
+
+
+ SwaggerUI
+
+
+
+
+
+
+
`))
})
```