lukaszraczylo/traefikoidc
1
0
Fork 0
mirror of https://github.com/lukaszraczylo/traefikoidc.git synced 2026-10-15 04:18:03 +00:00
Code Issues Packages Projects Releases Wiki Activity

R71: SSE/WS allowlist, session max-age, sec headers

Browse Source
This commit is contained in:
lukaszraczylo
2026-08-13 17:20:22 +01:00
parent 08de9b79aa
commit c408f7c295
3 changed files with 176 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
settings.go
+19
View File
@@ -521,6 +521,13 @@ func (c *Config) Validate() error {
return fmt.Errorf("maxRefreshTokenAgeSeconds cannot be negative")
}
// Validate session max age. A negative value would make every session
// "older than maxAge" immediately (time-since-createdAt > negative),
// permanently locking users out.
if c.SessionMaxAge < 0 {
return fmt.Errorf("sessionMaxAge cannot be negative")
}
// Validate audience if specified
if c.Audience != "" {
// Validate audience format - should be a valid identifier or URL
@@ -888,6 +895,18 @@ func (c *Config) GetSecurityHeadersApplier() func(http.ResponseWriter, *http.Req
if c.SecurityHeaders.ContentSecurityPolicy != "" {
headers.Set("Content-Security-Policy", c.SecurityHeaders.ContentSecurityPolicy)
}
if c.SecurityHeaders.PermissionsPolicy != "" {
headers.Set("Permissions-Policy", c.SecurityHeaders.PermissionsPolicy)
}
if c.SecurityHeaders.CrossOriginResourcePolicy != "" {
headers.Set("Cross-Origin-Resource-Policy", c.SecurityHeaders.CrossOriginResourcePolicy)
}
if c.SecurityHeaders.CrossOriginOpenerPolicy != "" {
headers.Set("Cross-Origin-Opener-Policy", c.SecurityHeaders.CrossOriginOpenerPolicy)
}
if c.SecurityHeaders.CrossOriginEmbedderPolicy != "" {
headers.Set("Cross-Origin-Embedder-Policy", c.SecurityHeaders.CrossOriginEmbedderPolicy)
}
// HSTS for HTTPS
if (req.TLS != nil || req.Header.Get("X-Forwarded-Proto") == "https") && c.SecurityHeaders.StrictTransportSecurity {