chore: add security http header

Author: achorein

docker/nginx-spa.conf

@@ -0,0 +1,69 @@
+user nginx;
+worker_processes auto;
+
+error_log /var/log/nginx/error.log warn;
+
+events {
+  worker_connections 1024;
+}
+
+http {
+  server_tokens off;
+  absolute_redirect off;
+  access_log /var/log/nginx/access.log;
+  default_type application/octet-stream;
+  error_log /var/log/nginx/error.log;
+  include /etc/nginx/mime.types;
+  keepalive_timeout 3000;
+  sendfile on;
+
+  server {
+    listen 8080;
+    root /usr/share/nginx/html;
+    index index.html;
+    server_name_in_redirect on;
+
+    add_header Referrer-Policy "no-referrer" always;
+    add_header X-XSS-Protection "0" always;
+    add_header X-Frame-Options "deny" always;
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header Content-Security-Policy "default-src 'self'; base-uri 'self'; font-src 'self' https: data:; form-action 'self'; frame-ancestors 'self'; img-src 'self' data: https://*.openstreetmap.org https://jedonnemonavis.numerique.gouv.fr; object-src 'none'; script-src 'self' https: 'unsafe-inline' 'unsafe-eval'; script-src-attr 'none'; style-src 'self' https: 'unsafe-inline'; connect-src 'self' https:; worker-src 'self' blob:;" always;
+
+    charset utf-8;
+
+    gzip on;
+    gzip_disable "msie6";
+    gzip_vary on;
+    gzip_proxied any;
+    gzip_comp_level 6;
+    gzip_buffers 16 8k;
+    gzip_http_version 1.1;
+    gzip_min_length 256;
+    gzip_types text/css application/json application/javascript application/x-javascript text/javascript application/vnd.ms-fontobject application/x-font-ttf font/opentype image/svg+xml image/x-icon;
+
+    client_max_body_size 32m;
+    error_page 500 502 503 504 /50x.html;
+
+    location / {
+      try_files $uri $uri.html $uri/index.html $uri/ /index.html;
+    }
+
+    location /50x.html {
+      root /var/lib/nginx/html;
+    }
+
+    location /live {
+      default_type text/plain;
+      return 200 'OK';
+    }
+
+    include /etc/nginx/ready_response.conf;
+    location /ready {
+      default_type text/plain;
+      if ($ready_response = 'OK') {
+        return 200 $ready_response;
+      }
+      return 500 'Not Ready';
+    }
+  }
+}

packages/backend/src/app.ts

@@ -48,7 +48,21 @@ const app = express();
 
 const log = logger(module.filename);
 
-app.use(helmet());
+app.use(
+  helmet({
+    contentSecurityPolicy: {
+      directives: {
+        "object-src": ["'none'"],
+        "script-src": ["'self'"],
+      },
+    },
+    referrerPolicy: { policy: "no-referrer" },
+  }),
+);
+app.use((_req, res, next) => {
+  res.setHeader("X-XSS-Protection", "0");
+  next();
+});
 
 const whitelist = [
   config.frontUsagersDomain,

packages/external-api/src/main.ts

@@ -11,6 +11,16 @@ patchNestJsSwagger();
 
 async function bootstrap() {
   const app = await NestFactory.create(AppModule, { bufferLogs: true });
+  app.use((_req, res, next) => {
+    res.setHeader("Referrer-Policy", "no-referrer");
+    res.setHeader("X-XSS-Protection", "0");
+    res.setHeader("X-Content-Type-Options", "nosniff");
+    res.setHeader(
+      "Content-Security-Policy",
+      "default-src 'self'; object-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'",
+    );
+    next();
+  });
   app.useLogger(app.get(Logger));
   const config = new DocumentBuilder()
     .setTitle("VAO Api")

packages/frontend-bo/Dockerfile

@@ -64,4 +64,5 @@ RUN --mount=type=secret,id=sentry_auth_token \
 
 FROM ghcr.io/socialgouv/docker/nginx4spa:8.2.4
 
+COPY docker/nginx-spa.conf /etc/nginx/nginx.conf
 COPY --from=builder --chown=101:101 /app/packages/frontend-bo/.output/public /usr/share/nginx/html

packages/frontend-bo/nuxt.config.ts

@@ -65,7 +65,10 @@ export default defineNuxtConfig({
   security: {
     headers: {
       crossOriginEmbedderPolicy: "unsafe-none",
+      referrerPolicy: "no-referrer",
+      xXSSProtection: "0",
       contentSecurityPolicy: {
+        "object-src": ["'none'"],
         "img-src": ["'self'", "*.openstreetmap.org", "data:"],
         "script-src": [
           "'self'",

packages/frontend-usagers/Dockerfile

@@ -65,4 +65,5 @@ RUN --mount=type=secret,id=sentry_auth_token \
 
 FROM ghcr.io/socialgouv/docker/nginx4spa:8.2.4
 
+COPY docker/nginx-spa.conf /etc/nginx/nginx.conf
 COPY --from=builder --chown=101:101 /app/packages/frontend-usagers/.output/public /usr/share/nginx/html

packages/frontend-usagers/nuxt.config.ts

@@ -60,7 +60,10 @@ export default defineNuxtConfig({
   security: {
     headers: {
       crossOriginEmbedderPolicy: "unsafe-none",
+      referrerPolicy: "no-referrer",
+      xXSSProtection: "0",
       contentSecurityPolicy: {
+        "object-src": ["'none'"],
         "img-src": [
           "'self'",
           "*.openstreetmap.org",