github.com/google/go-safeweb@v0.0.0-20231219055052-64d8cfc90fbb/examples/sample-application/secure/mux.go (about)

     1  // Copyright 2020 Google LLC
     2  //
     3  // Licensed under the Apache License, Version 2.0 (the "License");
     4  // you may not use this file except in compliance with the License.
     5  // You may obtain a copy of the License at
     6  //
     7  //	https://www.apache.org/licenses/LICENSE-2.0
     8  //
     9  // Unless required by applicable law or agreed to in writing, software
    10  // distributed under the License is distributed on an "AS IS" BASIS,
    11  // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
    12  // See the License for the specific language governing permissions and
    13  // limitations under the License.
    14  
    15  //go:build go1.16
    16  // +build go1.16
    17  
    18  package secure
    19  
    20  import (
    21  	"github.com/google/go-safeweb/safehttp"
    22  	"github.com/google/go-safeweb/safehttp/plugins/coop"
    23  	"github.com/google/go-safeweb/safehttp/plugins/csp"
    24  	"github.com/google/go-safeweb/safehttp/plugins/fetchmetadata"
    25  	"github.com/google/go-safeweb/safehttp/plugins/framing"
    26  	"github.com/google/go-safeweb/safehttp/plugins/hostcheck"
    27  	"github.com/google/go-safeweb/safehttp/plugins/hsts"
    28  	"github.com/google/go-safeweb/safehttp/plugins/staticheaders"
    29  	"github.com/google/go-safeweb/safehttp/plugins/xsrf/xsrfhtml"
    30  
    31  	"github.com/google/go-safeweb/examples/sample-application/secure/auth"
    32  	"github.com/google/go-safeweb/examples/sample-application/storage"
    33  )
    34  
    35  // NewMuxConfig creates a safe ServeMuxConfig.
    36  func NewMuxConfig(db *storage.DB, addr string) *safehttp.ServeMuxConfig {
    37  	c := safehttp.NewServeMuxConfig(nil)
    38  	c.Intercept(coop.Default(""))
    39  	c.Intercept(staticheaders.Interceptor{})
    40  	for _, i := range csp.Default("") {
    41  		c.Intercept(i)
    42  	}
    43  	c.Intercept(hsts.Default())
    44  
    45  	for _, i := range framing.Interceptors("") {
    46  		c.Intercept(i)
    47  	}
    48  	c.Intercept(fetchmetadata.ResourceIsolationPolicy())
    49  	c.Intercept(&xsrfhtml.Interceptor{SecretAppKey: "secret-key-that-should-not-be-in-sources"})
    50  	c.Intercept(auth.Interceptor{DB: db})
    51  	c.Intercept(hostcheck.New(addr))
    52  	return c
    53  }