From 5b580d9cea07cb81ab895b3e9d7d53f95f2de146 Mon Sep 17 00:00:00 2001
From: Timur Shemsedinov <timur.shemsedinov@gmail.com>
Date: Tue, 19 May 2020 02:58:32 +0300
Subject: [PATCH 1/3] Add security headers

Refs: https://github.com/HowProgrammingWorks/NodejsStarterKit/issues/125
---
 lib/client.js | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/lib/client.js b/lib/client.js
index 19f6b8b..7e102f8 100644
--- a/lib/client.js
+++ b/lib/client.js
@@ -12,6 +12,13 @@ const MIME_TYPES = {
   svg: 'image/svg+xml',
 };
 
+const HEADERS = {
+  'X-XSS-Protection': '1; mode=block',
+  'X-Content-Type-Options': 'nosniff',
+  'Strict-Transport-Security': 'max-age=31536000; includeSubdomains; preload',
+  'Access-Control-Allow-Origin': '*',
+};
+
 class Client {
   constructor(req, res, application, connection) {
     this.req = req;
@@ -25,7 +32,7 @@ class Client {
     const filePath = url === '/' ? '/index.html' : url;
     const fileExt = path.extname(filePath).substring(1);
     const mimeType = MIME_TYPES[fileExt] || MIME_TYPES.html;
-    res.writeHead(200, { 'Content-Type': mimeType });
+    res.writeHead(200, { ...HEADERS, 'Content-Type': mimeType });
     const data = application.static.get(filePath);
     if (data) res.end(data);
     else this.error(404);

From 60aff8eab50fa9e769fa2c2fe54441cc0657c5d1 Mon Sep 17 00:00:00 2001
From: Timur Shemsedinov <timur.shemsedinov@gmail.com>
Date: Tue, 19 May 2020 03:26:33 +0300
Subject: [PATCH 2/3] Add CSP headers

Closes: https://github.com/HowProgrammingWorks/NodejsStarterKit/issues/125
---
 lib/client.js | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/lib/client.js b/lib/client.js
index 7e102f8..0e742e7 100644
--- a/lib/client.js
+++ b/lib/client.js
@@ -17,6 +17,11 @@ const HEADERS = {
   'X-Content-Type-Options': 'nosniff',
   'Strict-Transport-Security': 'max-age=31536000; includeSubdomains; preload',
   'Access-Control-Allow-Origin': '*',
+  'Content-Security-Policy': [
+    'default-src \'self\'',
+    'style-src \'self\' https://fonts.googleapis.com',
+    'font-src \'self\' https://fonts.gstatic.com',
+  ].join('; '),
 };
 
 class Client {

From 0d035b0d5ec2fc6eac2197f89e4d27c2e1fbaffe Mon Sep 17 00:00:00 2001
From: Timur Shemsedinov <timur.shemsedinov@gmail.com>
Date: Tue, 19 May 2020 03:37:56 +0300
Subject: [PATCH 3/3] Connect websockets only to current page location

---
 static/console.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/static/console.js b/static/console.js
index 754d07c..5688113 100644
--- a/static/console.js
+++ b/static/console.js
@@ -2,7 +2,7 @@
 
 // API Builder
 
-const socket = new WebSocket('ws://127.0.0.1:8000/');
+const socket = new WebSocket('wss://' + location.host);
 
 const buildAPI = (methods, socket = null) => {
   const api = {};