@blakearoberts/visage 0.0.5-rc.11 → 0.0.5-rc.13
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +15 -21
- package/dist/config.d.ts +1 -1
- package/dist/config.d.ts.map +1 -1
- package/dist/index.js +62 -27
- package/dist/render/nginx.d.ts.map +1 -1
- package/dist/types.d.ts +13 -3
- package/dist/types.d.ts.map +1 -1
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -108,13 +108,14 @@ visage({
|
|
|
108
108
|
OAuth2 Proxy identity values can also be mapped explicitly through headers such
|
|
109
109
|
as `$auth_user`, `$auth_email`, `$auth_groups`, and `$auth_preferred_username`.
|
|
110
110
|
|
|
111
|
-
Authenticated locations also get
|
|
112
|
-
|
|
113
|
-
|
|
114
|
-
|
|
115
|
-
|
|
116
|
-
|
|
117
|
-
intentionally handles cross-site browser requests itself.
|
|
111
|
+
Authenticated locations also get CSRF checks by default. The policy allows
|
|
112
|
+
same-origin requests and top-level `GET` document navigations, blocks other
|
|
113
|
+
same-site and cross-site browser requests when modern Fetch Metadata headers are
|
|
114
|
+
present, and falls back to an exact `Origin` match or `Referer` origin-prefix
|
|
115
|
+
match against the configured browser origin for unsafe methods when Fetch
|
|
116
|
+
Metadata is absent or unrecognized. Set `csrf: false` when the upstream
|
|
117
|
+
intentionally handles cross-site browser requests itself. See
|
|
118
|
+
[CSRF Policy](../../docs/csrf-policy.md).
|
|
118
119
|
|
|
119
120
|
### External IdPs
|
|
120
121
|
|
|
@@ -175,15 +176,17 @@ terminates local HTTPS, and forwards authenticated identity or token material to
|
|
|
175
176
|
configured upstreams.
|
|
176
177
|
|
|
177
178
|
Please report suspected vulnerabilities through GitHub private vulnerability
|
|
178
|
-
reporting as described in [Security Policy](SECURITY.md).
|
|
179
|
+
reporting as described in [Security Policy](../../SECURITY.md).
|
|
179
180
|
|
|
180
181
|
Do not treat the managed Dex and OAuth2 Proxy defaults as production auth
|
|
181
182
|
infrastructure.
|
|
182
183
|
|
|
183
|
-
Visage's CSRF policy is
|
|
184
|
-
|
|
185
|
-
|
|
186
|
-
|
|
184
|
+
Visage's CSRF policy is the edge CSRF control for cookie-backed locations.
|
|
185
|
+
Application CSRF tokens are not required for ordinary same-origin SPA mutations
|
|
186
|
+
under this policy. App-level tokens may still be useful when a location disables
|
|
187
|
+
the edge policy, intentionally accepts cross-site browser requests, or needs a
|
|
188
|
+
token that encodes additional authorization semantics. CSP, `frame-ancestors`,
|
|
189
|
+
and other click-jacking controls remain application policy.
|
|
187
190
|
|
|
188
191
|
## Troubleshooting
|
|
189
192
|
|
|
@@ -192,12 +195,3 @@ application accepts form posts or other browser-submitted mutations. CSP,
|
|
|
192
195
|
- If NGINX cannot start, check whether the configured `port` is already in use.
|
|
193
196
|
- If the hostname cannot be resolved, Visage may need permission to update
|
|
194
197
|
`/etc/hosts`.
|
|
195
|
-
|
|
196
|
-
## TO-DO
|
|
197
|
-
|
|
198
|
-
- [ ] Harden the default security posture by addressing the
|
|
199
|
-
[security hardening backlog](docs/security-hardening.md).
|
|
200
|
-
- [ ] Support [runtime config reloads](docs/config-reload.md).
|
|
201
|
-
- [ ] Support [Dex connectors](https://dexidp.io/docs/connectors/).
|
|
202
|
-
- [ ] Support Dex on a distinct subdomain, such as `auth.localhost`.
|
|
203
|
-
- [ ] Support [HTTP mode without local TLS](docs/tls-http-mode.md).
|
package/dist/config.d.ts
CHANGED
|
@@ -22,7 +22,7 @@ type ResolvedProxyPolicy = {
|
|
|
22
22
|
readonly enabled: boolean;
|
|
23
23
|
readonly forward: false | 'id' | 'access';
|
|
24
24
|
};
|
|
25
|
-
readonly csrf:
|
|
25
|
+
readonly csrf: boolean;
|
|
26
26
|
readonly headers: Readonly<Record<string, string>>;
|
|
27
27
|
readonly directives: Readonly<Record<string, readonly string[]>>;
|
|
28
28
|
};
|
package/dist/config.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EACV,eAAe,EACf,gBAAgB,EAChB,aAAa,EACb,wBAAwB,EACxB,aAAa,EAEb,aAAa,EAEd,MAAM,SAAS,CAAC;AAEjB,KAAK,MAAM,GAAG,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;AAElD,KAAK,oBAAoB,GAAG;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B,CAAC;AAEF,KAAK,iBAAiB,GACpB;IAAE,QAAQ,CAAC,GAAG,EAAE,gBAAgB,CAAA;CAAE,GAAG,wBAAwB,CAAC;AAEhE,KAAK,oBAAoB,GAAG;IAC1B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B,CAAC;AAEF,KAAK,mBAAmB,GAAG;IACzB,QAAQ,CAAC,IAAI,EAAE;QACb,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;QAC1B,QAAQ,CAAC,OAAO,EAAE,KAAK,GAAG,IAAI,GAAG,QAAQ,CAAC;KAC3C,CAAC;IACF,QAAQ,CAAC,IAAI,EAAE,
|
|
1
|
+
{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EACV,eAAe,EACf,gBAAgB,EAChB,aAAa,EACb,wBAAwB,EACxB,aAAa,EAEb,aAAa,EAEd,MAAM,SAAS,CAAC;AAEjB,KAAK,MAAM,GAAG,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;AAElD,KAAK,oBAAoB,GAAG;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B,CAAC;AAEF,KAAK,iBAAiB,GACpB;IAAE,QAAQ,CAAC,GAAG,EAAE,gBAAgB,CAAA;CAAE,GAAG,wBAAwB,CAAC;AAEhE,KAAK,oBAAoB,GAAG;IAC1B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B,CAAC;AAEF,KAAK,mBAAmB,GAAG;IACzB,QAAQ,CAAC,IAAI,EAAE;QACb,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;QAC1B,QAAQ,CAAC,OAAO,EAAE,KAAK,GAAG,IAAI,GAAG,QAAQ,CAAC;KAC3C,CAAC;IACF,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACnD,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC;CAClE,CAAC;AAEF,KAAK,gBAAgB,GAAG;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC,CAAC;CACnE,CAAC;AAEF,KAAK,qBAAqB,GAAG;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAC;IACtC,QAAQ,CAAC,GAAG,EAAE,iBAAiB,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAC;IACtC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC;IAC3D,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;CACtD,CAAC;AAEF,KAAK,kBAAkB,GAAG;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;CACxC,CAAC;AAEF,KAAK,wBAAwB,GAAG,kBAAkB,GAAG;IACnD,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,KAAK,oBAAoB,GAAG;IAC1B,QAAQ,CAAC,GAAG,EAAE;QACZ,QAAQ,CAAC,MAAM,CAAC,EAAE,eAAe,CAAC;QAClC,QAAQ,CAAC,KAAK,EAAE,SAAS,aAAa,EAAE,CAAC;KAC1C,CAAC;IACF,QAAQ,CAAC,IAAI,EAAE,wBAAwB,CAAC;IACxC,QAAQ,CAAC,QAAQ,EAAE;QAAE,QAAQ,CAAC,GAAG,EAAE,gBAAgB,CAAA;KAAE,CAAC;CACvD,CAAC;AACF,KAAK,yBAAyB,GAAG;IAC/B,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE;QAAE,QAAQ,CAAC,GAAG,EAAE,gBAAgB,CAAA;KAAE,CAAC;CACvD,CAAC;AACF,KAAK,iBAAiB,GAAG,oBAAoB,GAAG,yBAAyB,CAAC;AAE1E,KAAK,eAAe,GAAG,IAAI,CAAC,aAAa,EAAE,UAAU,CAAC,GAAG;IACvD,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC;CACzD,CAAC;AAEF,KAAK,sBAAsB,GAAG,gBAAgB,GAAG;IAC/C,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;CAC5B,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAC;IACtC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,GAAG,EAAE,iBAAiB,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAC;IAEtC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE;QACd,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;QAChC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;KAC9B,CAAC;IACF,QAAQ,CAAC,OAAO,EAAE;QAChB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;QAC9B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;QAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;KAC1B,CAAC;IACF,QAAQ,CAAC,OAAO,EAAE;QAChB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;KACvB,CAAC;IAEF,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,CAAC;IAC7D,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC,CAAC;CACtE,CAAC;AAEF,eAAO,MAAM,mBAAmB,sBAAsB,CAAC;AAEvD,eAAO,MAAM,YAAY,EAKX,MAAM,CAAC,MAAM,EAAE;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AA0GhD,wBAAgB,cAAc,CAAC,OAAO,EAAE,aAAa,GAAG,qBAAqB,CAyD5E;AAgMD,wBAAgB,aAAa,CAC3B,OAAO,EAAE,qBAAqB,GAAG;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B,GACA,YAAY,CAqFd"}
|
package/dist/index.js
CHANGED
|
@@ -27,7 +27,7 @@ const BaseServiceOAuth2Proxy = {
|
|
|
27
27
|
};
|
|
28
28
|
const DefaultProxyPolicy = {
|
|
29
29
|
auth: { enabled: true, forward: false },
|
|
30
|
-
csrf:
|
|
30
|
+
csrf: true,
|
|
31
31
|
headers: {
|
|
32
32
|
Host: '$host',
|
|
33
33
|
// Mitigate header injection by clearing auth headers.
|
|
@@ -193,18 +193,13 @@ function resolveUpstreamsOptions(services, upstreams = {}) {
|
|
|
193
193
|
}
|
|
194
194
|
const BaseViteUpstreamRootLocation = {
|
|
195
195
|
auth: { enabled: true, forward: false },
|
|
196
|
-
csrf:
|
|
196
|
+
csrf: true,
|
|
197
|
+
ws: true,
|
|
197
198
|
headers: {
|
|
198
199
|
Host: '$host',
|
|
199
|
-
Upgrade: '$http_upgrade',
|
|
200
|
-
Connection: '$connection_upgrade',
|
|
201
200
|
'X-Auth-Request-User': '$auth_user',
|
|
202
201
|
'X-Auth-Request-Email': '$auth_email',
|
|
203
202
|
},
|
|
204
|
-
directives: {
|
|
205
|
-
proxy_http_version: ['1.1'],
|
|
206
|
-
proxy_read_timeout: ['1h'],
|
|
207
|
-
},
|
|
208
203
|
};
|
|
209
204
|
function resolveViteUpstreamOptions(upstream) {
|
|
210
205
|
const base = BaseViteUpstreamRootLocation;
|
|
@@ -220,6 +215,7 @@ function resolveViteUpstreamOptions(upstream) {
|
|
|
220
215
|
: {
|
|
221
216
|
auth: { ...base.auth, ...root.auth },
|
|
222
217
|
csrf: root.csrf ?? base.csrf,
|
|
218
|
+
ws: root.ws ?? base.ws,
|
|
223
219
|
headers: {
|
|
224
220
|
...base.headers,
|
|
225
221
|
...root.headers,
|
|
@@ -253,11 +249,12 @@ function resolveUpstreamOptions(name, upstream = {}, external) {
|
|
|
253
249
|
}
|
|
254
250
|
function resolveUpstreamLocationOptions(name, host, location, external) {
|
|
255
251
|
const auth = resolveAuthPolicy(location.auth, external && name !== 'vite');
|
|
252
|
+
const { ws, ...policy } = location;
|
|
256
253
|
return {
|
|
257
254
|
...DefaultProxyPolicy,
|
|
258
|
-
...
|
|
255
|
+
...policy,
|
|
259
256
|
auth,
|
|
260
|
-
csrf: location.csrf ??
|
|
257
|
+
csrf: location.csrf ?? auth.enabled,
|
|
261
258
|
headers: {
|
|
262
259
|
...DefaultProxyPolicy.headers,
|
|
263
260
|
...(external ? { Host: host } : {}),
|
|
@@ -267,10 +264,22 @@ function resolveUpstreamLocationOptions(name, host, location, external) {
|
|
|
267
264
|
...(auth.enabled && auth.forward === 'access'
|
|
268
265
|
? { Authorization: '"Bearer $access_token"' }
|
|
269
266
|
: {}),
|
|
267
|
+
...(ws
|
|
268
|
+
? {
|
|
269
|
+
Connection: '$connection_upgrade',
|
|
270
|
+
Upgrade: '$http_upgrade',
|
|
271
|
+
}
|
|
272
|
+
: {}),
|
|
270
273
|
...(location.headers ?? {}),
|
|
271
274
|
},
|
|
272
275
|
directives: {
|
|
273
276
|
...DefaultProxyPolicy.directives,
|
|
277
|
+
...(ws
|
|
278
|
+
? {
|
|
279
|
+
proxy_http_version: ['1.1'],
|
|
280
|
+
proxy_read_timeout: ['1h'],
|
|
281
|
+
}
|
|
282
|
+
: {}),
|
|
274
283
|
...Object.fromEntries(Object.entries(location.directives ?? {}).map(([name, value]) => [
|
|
275
284
|
name,
|
|
276
285
|
Array.isArray(value) ? value : [value],
|
|
@@ -807,16 +816,45 @@ http {
|
|
|
807
816
|
'' close;
|
|
808
817
|
}
|
|
809
818
|
|
|
810
|
-
# Fetch Metadata CSRF
|
|
811
|
-
map $
|
|
812
|
-
default
|
|
813
|
-
|
|
814
|
-
|
|
819
|
+
# Fetch Metadata CSRF guard for cookie auth locations.
|
|
820
|
+
map $request_method $csrf_method {
|
|
821
|
+
default unsafe;
|
|
822
|
+
GET safe;
|
|
823
|
+
HEAD safe;
|
|
824
|
+
OPTIONS safe;
|
|
815
825
|
}
|
|
816
|
-
map
|
|
817
|
-
default
|
|
818
|
-
|
|
819
|
-
|
|
826
|
+
map $http_origin $csrf_origin {
|
|
827
|
+
default invalid;
|
|
828
|
+
'' absent;
|
|
829
|
+
"<%~ it.csrf.origin %>" match;
|
|
830
|
+
}
|
|
831
|
+
map $http_referer $csrf_referer {
|
|
832
|
+
default invalid;
|
|
833
|
+
'' absent;
|
|
834
|
+
"<%~ it.csrf.referer %>" match;
|
|
835
|
+
}
|
|
836
|
+
map "$csrf_method:$csrf_origin:$csrf_referer" $csrf_fallback {
|
|
837
|
+
default deny;
|
|
838
|
+
"~^safe:.*:.*$" allow;
|
|
839
|
+
unsafe:match:match allow;
|
|
840
|
+
unsafe:match:absent allow;
|
|
841
|
+
unsafe:absent:match allow;
|
|
842
|
+
}
|
|
843
|
+
map "$request_method:$http_sec_fetch_mode:$http_sec_fetch_dest" $csrf_doc_nav {
|
|
844
|
+
default 0;
|
|
845
|
+
GET:navigate:document 1;
|
|
846
|
+
}
|
|
847
|
+
map "$http_sec_fetch_site:$csrf_doc_nav" $csrf_fetch_metadata {
|
|
848
|
+
default fallback;
|
|
849
|
+
"~^(same-origin|none):(0|1)$" allow;
|
|
850
|
+
"~^(same-site|cross-site):1$" allow;
|
|
851
|
+
"~^(same-site|cross-site):0$" deny;
|
|
852
|
+
}
|
|
853
|
+
map "$csrf_fetch_metadata:$csrf_fallback" $csrf_reject {
|
|
854
|
+
default 1;
|
|
855
|
+
allow:deny 0;
|
|
856
|
+
allow:allow 0;
|
|
857
|
+
fallback:allow 0;
|
|
820
858
|
}
|
|
821
859
|
map "$request_method:$http_sec_fetch_mode:$http_sec_fetch_dest" $auth_error_page {
|
|
822
860
|
default @auth_401;
|
|
@@ -852,16 +890,10 @@ http {
|
|
|
852
890
|
<%_ for (const [path, location] of Object.entries(upstream.locations)) { %>
|
|
853
891
|
location <%~ path %> {
|
|
854
892
|
<%_ if (location.csrf) { %>
|
|
855
|
-
add_header Vary "Sec-Fetch-Site, Sec-Fetch-Mode, Sec-Fetch-Dest" always;
|
|
856
|
-
|
|
857
|
-
if ($csrf_app) {
|
|
858
|
-
return 403;
|
|
859
|
-
}
|
|
860
|
-
<%_ } else { %>
|
|
861
|
-
if ($csrf_api) {
|
|
893
|
+
add_header Vary "Sec-Fetch-Site, Sec-Fetch-Mode, Sec-Fetch-Dest, Origin, Referer" always;
|
|
894
|
+
if ($csrf_reject) {
|
|
862
895
|
return 403;
|
|
863
896
|
}
|
|
864
|
-
<%_ } %>
|
|
865
897
|
|
|
866
898
|
<%_ } %>
|
|
867
899
|
<%_ if (location.auth?.enabled) { %>
|
|
@@ -932,9 +964,12 @@ function writeNginxConfig(config) {
|
|
|
932
964
|
writeFileSync(edgeKeyFile, edgeKeyRender, 'utf-8');
|
|
933
965
|
}
|
|
934
966
|
function renderNginxConfig(config) {
|
|
967
|
+
const origin = `https://${config.host}:${config.port}`;
|
|
968
|
+
const referer = `~^${origin.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}([/?#]|$)`;
|
|
935
969
|
const data = {
|
|
936
970
|
host: config.host,
|
|
937
971
|
port: config.port,
|
|
972
|
+
csrf: { origin, referer },
|
|
938
973
|
ssl: {
|
|
939
974
|
cert: join(config.files.certs[1], 'tls.crt'),
|
|
940
975
|
key: join(config.files.certs[1], 'tls.key'),
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"nginx.d.ts","sourceRoot":"","sources":["../../src/render/nginx.ts"],"names":[],"mappings":"AAIA,OAAO,EAAuB,KAAK,YAAY,EAAE,MAAM,WAAW,CAAC;
|
|
1
|
+
{"version":3,"file":"nginx.d.ts","sourceRoot":"","sources":["../../src/render/nginx.ts"],"names":[],"mappings":"AAIA,OAAO,EAAuB,KAAK,YAAY,EAAE,MAAM,WAAW,CAAC;AA0KnE,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI,CAQ3D"}
|
package/dist/types.d.ts
CHANGED
|
@@ -368,10 +368,20 @@ export type VisageProxyPolicy = {
|
|
|
368
368
|
* locations. Set this to `false` when an upstream handles CSRF itself or
|
|
369
369
|
* intentionally accepts cross-site browser requests.
|
|
370
370
|
*
|
|
371
|
-
* @defaultValue `
|
|
372
|
-
*
|
|
371
|
+
* @defaultValue `true` for authenticated locations; `false` for
|
|
372
|
+
* unauthenticated locations.
|
|
373
373
|
*/
|
|
374
|
-
readonly csrf?:
|
|
374
|
+
readonly csrf?: boolean;
|
|
375
|
+
/**
|
|
376
|
+
* Whether to add WebSocket proxy support for this location.
|
|
377
|
+
*
|
|
378
|
+
* When enabled, Visage adds `Connection` and `Upgrade` proxy headers plus
|
|
379
|
+
* `proxy_http_version` and `proxy_read_timeout` directives unless the
|
|
380
|
+
* location explicitly overrides them.
|
|
381
|
+
*
|
|
382
|
+
* @defaultValue `false`
|
|
383
|
+
*/
|
|
384
|
+
readonly ws?: boolean;
|
|
375
385
|
/**
|
|
376
386
|
* Request headers to set when proxying to the upstream. Values may include
|
|
377
387
|
* NGINX variables. These are merged with Visage's default proxy headers:
|
package/dist/types.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,kBAAkB,CAAC;IACrC;;;OAGG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,gBAAgB,GAAG,wBAAwB,CAAC;IAC3D;;OAEG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,kBAAkB,CAAC;IACrC;;;OAGG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAClD;;OAEG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;CACrD,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAC/B;;;;;;OAMG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;OAOG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;;;OAQG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC;;;;;OAKG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,eAAe,CAAC;IAClC;;;;OAIG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,aAAa,EAAE,CAAC;CAC3C,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B;;OAEG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;OAEG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;OAEG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC;;OAEG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;OAEG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE;QACvB;;WAEG;QACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;QACpC;;WAEG;QACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;QACnC;;WAEG;QACH,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC;QACnC;;WAEG;QACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;KACjC,CAAC;CACH,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;OAEG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,wBAAwB,GAAG;IACrC;;;OAGG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;;;OAIG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC;;;;;OAKG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;OAMG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC;;;;OAIG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;CACxC,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;;;;OAOG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC3C,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB;;OAEG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC;;OAEG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE;QAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAAA;KAAE,CAAC;IAC3D;;OAEG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC;;OAEG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;OAEG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,GAAG,IAAI,GAAG,YAAY,GAAG,gBAAgB,CAAC;IACrE;;OAEG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC;;;OAGG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAC;CACpC,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,cAAc,GAAG;IAC3B;;;;OAIG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IACnC;;;;OAIG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE;QAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;KAAE,CAAC;IACtD;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE;QAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,GAAG,iBAAiB,CAAA;KAAE,CAAC;CACrE,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC9B;;OAEG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE;QACd;;;;WAIG;QACH,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;QAC3B;;;;;;;;;WASG;QACH,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,GAAG,IAAI,GAAG,QAAQ,CAAC;KAC9C,CAAC;IACF;;;;;;;OAOG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,
|
|
1
|
+
{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,kBAAkB,CAAC;IACrC;;;OAGG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,gBAAgB,GAAG,wBAAwB,CAAC;IAC3D;;OAEG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,kBAAkB,CAAC;IACrC;;;OAGG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAClD;;OAEG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;CACrD,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAC/B;;;;;;OAMG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;OAOG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;;;OAQG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC;;;;;OAKG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,eAAe,CAAC;IAClC;;;;OAIG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,aAAa,EAAE,CAAC;CAC3C,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B;;OAEG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;OAEG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;OAEG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC;;OAEG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;OAEG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE;QACvB;;WAEG;QACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;QACpC;;WAEG;QACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;QACnC;;WAEG;QACH,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC;QACnC;;WAEG;QACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;KACjC,CAAC;CACH,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;OAEG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,wBAAwB,GAAG;IACrC;;;OAGG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;;;OAIG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC;;;;;OAKG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;OAMG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC;;;;OAIG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;CACxC,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;;;;OAOG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC3C,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB;;OAEG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC;;OAEG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE;QAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAAA;KAAE,CAAC;IAC3D;;OAEG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC;;OAEG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;OAEG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,GAAG,IAAI,GAAG,YAAY,GAAG,gBAAgB,CAAC;IACrE;;OAEG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC;;;OAGG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAC;CACpC,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,cAAc,GAAG;IAC3B;;;;OAIG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IACnC;;;;OAIG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE;QAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;KAAE,CAAC;IACtD;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE;QAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,GAAG,iBAAiB,CAAA;KAAE,CAAC;CACrE,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC9B;;OAEG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE;QACd;;;;WAIG;QACH,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;QAC3B;;;;;;;;;WASG;QACH,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,GAAG,IAAI,GAAG,QAAQ,CAAC;KAC9C,CAAC;IACF;;;;;;;OAOG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB;;;;;;;;OAQG;IACH,QAAQ,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC;IACtB;;;;;;OAMG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE;QAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;KAAE,CAAC;IACtD;;;;OAIG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE;QACpB,QAAQ,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,MAAM,EAAE,CAAC;KACrD,CAAC;CACH,CAAC"}
|
package/package.json
CHANGED