Jennie Robinson Faber
26c300c357
Auth: Add requireAuth/requireAdmin guards with JWT cookie verification, member status checks (suspended/cancelled = 403), and admin role enforcement. Apply to all admin, upload, and payment endpoints. Add role field to Member model. CSRF: Double-submit cookie middleware with client plugin. Exempt webhook and magic-link verify routes. Headers: X-Content-Type-Options, X-Frame-Options, X-XSS-Protection, Referrer-Policy, Permissions-Policy on all responses. HSTS and CSP (Helcim/Cloudinary/Plausible sources) in production only. Rate limiting: Auth 5/5min, payment 10/min, upload 10/min, general 100/min via rate-limiter-flexible, keyed by client IP. XSS: DOMPurify sanitization on marked() output with tag/attr allowlists. escapeHtml() utility for email template interpolation. Anti-enumeration: Login returns identical response for existing and non-existing emails. Remove 404 handling from login UI components. Mass assignment: Remove helcimCustomerId from profile allowedFields. Session: 7-day token expiry, refresh endpoint, httpOnly+secure cookies. Environment: Validate required secrets on startup via server plugin. Remove JWT_SECRET hardcoded fallback.
30 lines
1.2 KiB
JavaScript
30 lines
1.2 KiB
JavaScript
export default defineEventHandler((event) => {
|
|
const headers = {
|
|
'X-Content-Type-Options': 'nosniff',
|
|
'X-Frame-Options': 'DENY',
|
|
'X-XSS-Protection': '0',
|
|
'Referrer-Policy': 'strict-origin-when-cross-origin',
|
|
'Permissions-Policy': 'camera=(), microphone=(), geolocation=()',
|
|
}
|
|
|
|
if (process.env.NODE_ENV === 'production') {
|
|
headers['Strict-Transport-Security'] = 'max-age=31536000; includeSubDomains'
|
|
|
|
// CSP: allow self, Cloudinary images, HelcimPay.js, Plausible analytics
|
|
headers['Content-Security-Policy'] = [
|
|
"default-src 'self'",
|
|
"script-src 'self' 'unsafe-inline' 'unsafe-eval' https://myposjs.helcim.com https://plausible.io",
|
|
"style-src 'self' 'unsafe-inline'",
|
|
"img-src 'self' data: https://res.cloudinary.com https://*.cloudinary.com",
|
|
"font-src 'self'",
|
|
"connect-src 'self' https://api.helcim.com https://myposjs.helcim.com https://plausible.io",
|
|
"frame-src 'self' https://myposjs.helcim.com https://secure.helcim.com",
|
|
"base-uri 'self'",
|
|
"form-action 'self'",
|
|
].join('; ')
|
|
}
|
|
|
|
for (const [key, value] of Object.entries(headers)) {
|
|
setHeader(event, key, value)
|
|
}
|
|
})
|