CSP headers

build/Dockerfile

@@ -62,6 +62,13 @@ ENV WEBDAV_URL="http://localhost"
 ENV COUCHDB_URL="http://localhost"
 # The language which should be loaded on default options are "en-US" and "de"
 ENV DEFAULT_LANGUAGE="en-US"
+
+# url to be reverse-proxied for logging endpoint (e.g. sentry.io)
+ENV LOGGING_URL=""
+
+ENV CSP_SRC_ALLOW=""
+ENV CSP_FRAME_ALLOW=""
+ENV CSP_REPORT_URI=""
 # variables are inserted into the nginx config
-CMD envsubst '$$PORT $$WEBDAV_URL $$COUCHDB_URL $$DEFAULT_LANGUAGE' < /etc/nginx/templates/default.conf > /etc/nginx/conf.d/default.conf &&\
+CMD envsubst '$$PORT $$WEBDAV_URL $$COUCHDB_URL $$DEFAULT_LANGUAGE $$LOGGING_URL $$CSP_SRC_ALLOW $$CSP_FRAME_ALLOW $$CSP_REPORT_URI' < /etc/nginx/templates/default.conf > /etc/nginx/conf.d/default.conf &&\
     nginx -g 'daemon off;'

build/README.md

@@ -10,6 +10,14 @@ for every official (tagged) build.
 ## How to build & publish a new image
 You can simply create a new git tag and the CI setup will build and publish a docker image for that version.
 
+## Building locally
+Run the following commands from the root folder to build, run and kill the application on your local machine:
+```
+docker build -f build/Dockerfile -t aam/digital:latest .
+docker run -p=80:80 aam/digital:latest
+docker kill aam-digital
+```
+
 ## How does the official release process work?
 We use [semantic-release](https://github.com/semantic-release/semantic-release) to automatically create new versions.
 Our process roughly follows the [GitFlow](https://www.atlassian.com/git/tutorials/comparing-workflows/gitflow-workflow) process,

build/default.conf

@@ -7,6 +7,10 @@ server {
 
     root /usr/share/nginx/html;
 
+    add_header Content-Security-Policy-Report-Only "default-src 'self' ${CSP_SRC_ALLOW}; frame-ancestors 'self' ${CSP_FRAME_ALLOW}; trusted-types angular; require-trusted-types-for 'script'; report-uri ${CSP_REPORT_URI}";
+    add_header X-Frame-Options: SAMEORIGIN; # only applies in older browsers, CSP frame-ancestors takes prevalence https://stackoverflow.com/a/40417609/1473411
+    add_header X-Content-Type-Options: nosniff;
+
     # Catch requests to the (locale) assets folder and add fallback to super-folder
     # E.g. if '/en-US/assets/config.json' doesn't exist, try '/assets/config.json'
     location ~* ^/.+/assets/(.+)$ {
@@ -52,5 +56,11 @@ server {
         rewrite /webdav/(.*) /$1 break;
         proxy_pass ${WEBDAV_URL};
     }
+
+    location /logging {
+        rewrite /logging/(.*) /$1 break;
+        add_header Content-Type: application/x-sentry-envelope;
+        proxy_pass ${LOGGING_URL};
+    }
 }
 

proxy.conf.json

@@ -5,6 +5,12 @@
     "logLevel": "debug",
     "changeOrigin": true
   },
+  "/logging": {
+    "target": "http://localhost:81",
+    "secure": true,
+    "logLevel": "debug",
+    "changeOrigin": true
+  },
   "/nextcloud": {
     "target": "https://nextcloud.aam-digital.com/remote.php/webdav",
     "secure": true,

src/app/app.module.ts

@@ -163,6 +163,8 @@ export class AppModule {}
 
 // Initialize remote logging
 LoggingService.initRemoteLogging({
+
   dsn: environment.remoteLoggingDsn,
-  whitelistUrls: [/https?:\/\/(.*)\.?aam-digital\.com/],
+  tunnel: "/logging",
+  //TODO: reactivate before merge //whitelistUrls: [/https?:\/\/(.*)\.?aam-digital\.com/],
 });

src/environments/environment.ts

@@ -27,5 +27,5 @@ export const environment = {
   production: false,
   appVersion: "0.0.0", // replaced automatically during docker build
   repositoryId: "Aam-Digital/ndb-core",
-  remoteLoggingDsn: undefined, // only set for production mode in environment.prod.ts
+  remoteLoggingDsn: "https://bd6aba79ca514d35bb06a4b4e0c2a21e@sentry.io/1242399", //TODO: reset // only set for production mode in environment.prod.ts
 };