@jondotsoy/envs 0.1.9-alpha.3 → 0.1.9-alpha.4

package/envs.js

@@ -503,6 +503,12 @@ async function serveUi(ctx) {
   let token = randomBytes(24).toString("base64url");
   const session = randomBytes(24).toString("base64url");
   const guard = (handler) => async (req) => {
+    const res = await check(req, handler);
+    for (const [name, value] of Object.entries(HARDENING_HEADERS))
+      res.headers.set(name, value);
+    return res;
+  };
+  const check = async (req, handler) => {
     const port = server.port;
     const hosts = [`127.0.0.1:${port}`, `localhost:${port}`];
     if (!hosts.includes(req.headers.get("host") ?? "")) {
@@ -513,7 +519,7 @@ async function serveUi(ctx) {
       return new Response("Forbidden origin", { status: 403 });
     }
     const url = new URL(req.url);
-    if (url.pathname === "/" && sameToken(url.searchParams.get("token"), token)) {
+    if (req.method === "GET" && url.pathname === "/" && sameToken(url.searchParams.get("token"), token)) {
       token = randomBytes(24).toString("base64url");
       ctx.log(`New single-use URL: ${urlWith(token)}`);
       opened?.then((cleanup) => cleanup?.(), () => {});
@@ -521,13 +527,16 @@ async function serveUi(ctx) {
         status: 302,
         headers: {
           location: "/",
-          "set-cookie": `${TOKEN_COOKIE}=${session}; HttpOnly; SameSite=Strict; Path=/`
+          "set-cookie": `${TOKEN_COOKIE}=${session}; HttpOnly; SameSite=Lax; Path=/`
         }
       });
     }
     if (!sameToken(presentedToken(req), session)) {
       return new Response("Unauthorized: open the address printed by `envs edit --ui`.", { status: 401 });
     }
+    if (!["GET", "HEAD", "PUT", "POST"].includes(req.method)) {
+      return new Response("Method not allowed", { status: 405, headers: { allow: "GET, HEAD, PUT, POST" } });
+    }
     if (req.method !== "GET" && req.method !== "HEAD" && !req.headers.get("content-type")?.toLowerCase().startsWith("application/json")) {
       return new Response("Unsupported media type", { status: 415 });
     }
@@ -592,10 +601,15 @@ async function serveUi(ctx) {
   await server.stop(true);
   return 0;
 }
-var ANSI, isRecord = (v) => typeof v === "object" && v !== null && !Array.isArray(v), isScalar = (v) => ["string", "number", "boolean"].includes(typeof v), TOKEN_COOKIE = "envs_token", MAX_BODY_BYTES;
+var ANSI, isRecord = (v) => typeof v === "object" && v !== null && !Array.isArray(v), isScalar = (v) => ["string", "number", "boolean"].includes(typeof v), TOKEN_COOKIE = "envs_token", HARDENING_HEADERS, MAX_BODY_BYTES;
 var init_server = __esm(() => {
   init_envs();
   ANSI = /\x1b\[[0-9;]*m/g;
+  HARDENING_HEADERS = {
+    "x-content-type-options": "nosniff",
+    "content-security-policy": "default-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; base-uri 'none'; form-action 'none'; frame-ancestors 'none'",
+    "referrer-policy": "no-referrer"
+  };
   MAX_BODY_BYTES = 5 * 1024 * 1024;
 });
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jondotsoy/envs",
-  "version": "0.1.9-alpha.3",
+  "version": "0.1.9-alpha.4",
   "license": "MIT",
   "author": {
     "name": "Jonathan Delgado",