diff --git a/web/astro.config.mjs b/web/astro.config.mjs index 39b2259..855ed1a 100644 --- a/web/astro.config.mjs +++ b/web/astro.config.mjs @@ -14,6 +14,8 @@ import { postgresListener } from './src/lib/postgresListenerIntegration' import { getServerEnvVariable } from './src/lib/serverEnvVariables' const SITE_URL = getServerEnvVariable('SITE_URL') +const ONION_ADDRESS = getServerEnvVariable('ONION_ADDRESS') +const I2P_ADDRESS = getServerEnvVariable('I2P_ADDRESS') export default defineConfig({ site: SITE_URL, @@ -95,6 +97,18 @@ export default defineConfig({ server: { open: false, allowedHosts: [new URL(SITE_URL).hostname], + headers: { + 'Onion-Location': ONION_ADDRESS, + 'X-I2P-Location': I2P_ADDRESS, + 'X-Frame-Options': 'DENY', + // Astro is working on this feature, when it's stable use it instead of this. + // https://astro.build/blog/astro-590/#experimental-content-security-policy-support + 'Content-Security-Policy': + SITE_URL === 'http://localhost:4321' + ? "frame-ancestors 'none'; upgrade-insecure-requests" + : "default-src 'self'; img-src 'self' *; frame-ancestors 'none'; upgrade-insecure-requests", + 'Strict-Transport-Security': 'max-age=31536000; includeSubdomains; preload;', + }, }, image: { domains: [new URL(SITE_URL).hostname], diff --git a/web/package-lock.json b/web/package-lock.json index f6a65eb..04dd2ab 100644 --- a/web/package-lock.json +++ b/web/package-lock.json @@ -28,6 +28,7 @@ "astro-seo-schema": "5.0.0", "canvas": "3.1.2", "clsx": "2.1.1", + "he": "1.2.0", "htmx.org": "2.0.6", "javascript-time-ago": "2.5.11", "libphonenumber-js": "1.12.9", @@ -59,6 +60,7 @@ "@tailwindcss/forms": "0.5.10", "@tailwindcss/typography": "0.5.16", "@types/eslint__js": "9.14.0", + "@types/he": "1.2.3", "@types/lodash-es": "4.17.12", "@types/qrcode": "1.5.5", "@types/react": "19.1.8", @@ -4763,6 +4765,13 @@ "@types/unist": "*" } }, + "node_modules/@types/he": { + "version": "1.2.3", + "resolved": "https://registry.npmjs.org/@types/he/-/he-1.2.3.tgz", + "integrity": "sha512-q67/qwlxblDzEDvzHhVkwc1gzVWxaNxeyHUBF4xElrvjL11O+Ytze+1fGpBHlr/H9myiBUaUXNnNPmBHxxfAcA==", + "dev": true, + "license": "MIT" + }, "node_modules/@types/json-schema": { "version": "7.0.15", "resolved": "https://registry.npmjs.org/@types/json-schema/-/json-schema-7.0.15.tgz", @@ -10820,6 +10829,15 @@ "url": "https://opencollective.com/unified" } }, + "node_modules/he": { + "version": "1.2.0", + "resolved": "https://registry.npmjs.org/he/-/he-1.2.0.tgz", + "integrity": "sha512-F/1DnUGPopORZi0ni+CvrCgHQ5FyEAHRLSApuYWMmrbSwoN2Mn/7k+Gl38gJnR7yyDZk6WLXwiGod1JOWNDKGw==", + "license": "MIT", + "bin": { + "he": "bin/he" + } + }, "node_modules/hex-rgb": { "version": "4.3.0", "resolved": "https://registry.npmjs.org/hex-rgb/-/hex-rgb-4.3.0.tgz", diff --git a/web/package.json b/web/package.json index 85be03b..89995c6 100644 --- a/web/package.json +++ b/web/package.json @@ -44,6 +44,7 @@ "astro-seo-schema": "5.0.0", "canvas": "3.1.2", "clsx": "2.1.1", + "he": "1.2.0", "htmx.org": "2.0.6", "javascript-time-ago": "2.5.11", "libphonenumber-js": "1.12.9", @@ -75,6 +76,7 @@ "@tailwindcss/forms": "0.5.10", "@tailwindcss/typography": "0.5.16", "@types/eslint__js": "9.14.0", + "@types/he": "1.2.3", "@types/lodash-es": "4.17.12", "@types/qrcode": "1.5.5", "@types/react": "19.1.8", diff --git a/web/src/components/BaseHead.astro b/web/src/components/BaseHead.astro index e7955fe..a5d971f 100644 --- a/web/src/components/BaseHead.astro +++ b/web/src/components/BaseHead.astro @@ -1,6 +1,7 @@ --- import LoadingIndicator from 'astro-loading-indicator/component' import { Schema } from 'astro-seo-schema' +import { ONION_ADDRESS } from 'astro:env/server' import { ClientRouter } from 'astro:transitions' import { pwaAssetsHead } from 'virtual:pwa-assets/head' import { pwaInfo } from 'virtual:pwa-info' @@ -78,30 +79,32 @@ const fullTitle = `${pageTitle} | KYCnot.me ${modeName}` const ogImageUrl = makeOgImageUrl(ogImage, Astro.url) --- - +{/* Primary Meta Tags */}