csp

README

csp

csp provides a Go HTTP handler for setting Content-Security-Policy headers and receiving CSP violation reports.

Usage

go get sourcegraph.com/sourcegraph/csp

Documentation

Overview

Package csp provides an HTTP handler for setting Content-Security-Policy headers and receiving CSP violation reports.

Index

• type Config
• type Handler
  • func NewHandler(cfg Config) *Handler
  • func (h *Handler) ServeHTTP(w http.ResponseWriter, r *http.Request, next http.HandlerFunc)
• type Policy

Types

type Config

type Config struct {
	Policy           *Policy // if non-nil, configures the Content-Security-Policy header
	PolicyReportOnly *Policy // if non-nil, configures the Content-Security-Policy-Report-Only header
}

Config configures the Content Security Policy headers sent by Handler.

type Handler

type Handler struct {

	// ReportLog is the logger that CSP violation reports are sent
	// to. If nil, the default logger (from package log) is used.
	ReportLog *log.Logger
	// contains filtered or unexported fields
}

Handler sets Content-Security-Policy{,-Report-Only} headers and logs CSP reports to stderr.

func NewHandler

func NewHandler(cfg Config) *Handler

NewHandler creates a new handler that adds the configured Content Security Policy (CSP) headers to HTTP responses. If cfg is invalid, NewHandler returns an error.

func (*Handler) ServeHTTP

func (h *Handler) ServeHTTP(w http.ResponseWriter, r *http.Request, next http.HandlerFunc)

ServeHTTP implements http.Handler.

type Policy

type Policy struct {
	DefaultSrc []string
	ScriptSrc  []string
	ObjectSrc  []string
	StyleSrc   []string
	ImgSrc     []string
	MediaSrc   []string
	FrameSrc   []string
	FontSrc    []string
	ConnectSrc []string
	ReportURI  string
}

Policy describes a Content Security Policy.