yakuza0 2.22.37 → 2.22.38
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/package.json +1 -1
- package/server/proxy/csrf.js +5 -3
- package/utils/inclusive.js +3 -1
package/package.json
CHANGED
package/server/proxy/csrf.js
CHANGED
|
@@ -273,18 +273,20 @@ exports.default = function () {
|
|
|
273
273
|
// const browsers = Object.keys(yConf.allowBrowsers);
|
|
274
274
|
|
|
275
275
|
if (_config2.default.security.helmet) {
|
|
276
|
-
helmetOptions = {
|
|
276
|
+
helmetOptions = (0, _extends3.default)({
|
|
277
277
|
// referrerPolicy: { policy: "no-referrer-when-downgrade" },
|
|
278
278
|
// referrerPolicy: { policy: "strict-origin-when-cross-origin" },
|
|
279
279
|
// referrerPolicy: yConf.stupid.referrerPolicy.policy,
|
|
280
280
|
// referrerPolicy: { policy: "origin-when-crossorigin" },
|
|
281
|
-
referrerPolicy: _config2.default.server.stupid.referrerPolicy
|
|
281
|
+
referrerPolicy: _config2.default.server.stupid.referrerPolicy,
|
|
282
282
|
// crossOriginResourcePolicy: yConf.server.hm.crossOriginEmbedderPolicy,
|
|
283
283
|
// crossOriginEmbedderPolicy: true,
|
|
284
284
|
// crossOriginResourcePolicy: { policy: "cross-origin" },
|
|
285
285
|
// crossOriginResourcePolicy: { policy: "same-origin" }
|
|
286
286
|
// contentSecurityPolicy: yConf.server.csp.decoration,
|
|
287
|
-
|
|
287
|
+
// xFrameOptions: false,
|
|
288
|
+
xFrameOptions: _config2.default.server.stupid.xFrameOptions
|
|
289
|
+
}, _config2.default.server.stupid.helmet);
|
|
288
290
|
|
|
289
291
|
|
|
290
292
|
if (_config2.default.server.csp.decoration === true) {
|
package/utils/inclusive.js
CHANGED
|
@@ -529,13 +529,15 @@ var render = function () {
|
|
|
529
529
|
stupid: {
|
|
530
530
|
referrerPolicy: { policy: "strict-origin-when-cross-origin" },
|
|
531
531
|
crossOriginResourcePolicy: { policy: "same-origin" },
|
|
532
|
+
xFrameOptions: { action: "sameorigin" },
|
|
532
533
|
standard: "v23", // v13
|
|
533
534
|
v23: {
|
|
534
535
|
// aMark: '__cfo_complete_',
|
|
535
536
|
enabled: true,
|
|
536
537
|
tsLoading: 5000,
|
|
537
538
|
tsLoaded: 120000
|
|
538
|
-
}
|
|
539
|
+
},
|
|
540
|
+
helmet: {}
|
|
539
541
|
},
|
|
540
542
|
tire: {
|
|
541
543
|
guPath: '/gu',
|