Class NextDashboardSecurityHeaders

java.lang.Object
com.kingsrook.qqq.middleware.javalin.routeproviders.NextDashboardSecurityHeaders
public final class NextDashboardSecurityHeaders extends Object
Security response headers for the QQQ Next dashboard (QRun-IO/qqq#695). The defaults are strict and match what the static export needs: - Content-Security-Policy: everything from the application's own origin; inline scripts only by the SHA-256 hash of each script in the served page (the provider adds these per document); no plugins, no base-URI or form targets elsewhere, and the dashboard may not be framed. Inline styles are allowed: the UI's dialog scroll lock, toasts and React style hoisting create style elements at runtime, and branding customCss is applied as a style element. Images may also come from any HTTPS origin (branding logos and image fields hold external URLs). - X-Frame-Options DENY (for browsers without frame-ancestors). - Referrer-Policy strict-origin-when-cross-origin: other origins see only the application origin, never a path or query (such as an authorization code). - Permissions-Policy: device and sensor features the dashboard never uses are disabled. - X-Content-Type-Options nosniff. NextDashboardRouteProvider adds the configured identity provider origins to connect-src (OAUTH2 discovery, AUTH_0 token exchange), the QuickSight origin to frame-src when the instance has a quickSightChart widget, the origin of each customComponent widget's componentSourceUrl to script-src, and, only for the analytics providers the instance configures (QQQ_ENV_* GOOGLE_ANALYTICS_*, POSTHOG_*, ANALYTICS_PLUGIN_SCRIPTS; QRun-IO/qqq#730), their script origins to script-src and the origins they send to to connect-src (see NextDashboardAnalyticsOrigins). When both Google Drive browser settings are configured, Google identity and picker script, frame, connect and style sources are added as well. Applications change the policy with QApplicationJavalinServer.withNextDashboardSecurityHeadersCustomizer, which receives this object after those additions.

  • Field Details

  • Constructor Details

    • NextDashboardSecurityHeaders

      public NextDashboardSecurityHeaders()
      The default (strict) policy and headers.

  • Method Details

    • originOf

      public static String originOf(String url)
      The origin (scheme://host[:port]) of a URL, for use as a CSP source.
      Parameters:
      url - an absolute http(s) URL, such as an identity provider base URL
      Returns:
      the origin, or null when the URL is blank, relative or not http(s)

    • withDirective

      public NextDashboardSecurityHeaders withDirective(String directive, String... sources)
      Replace a directive's sources (for example withDirective("frame-ancestors", "'self'") to allow same-origin framing).
      Parameters:
      directive - CSP directive name, lowercase
      sources - source expressions; none gives a directive without sources
      Returns:
      this

    • withSources

      public NextDashboardSecurityHeaders withSources(String directive, String... sources)
      Add sources to a directive, creating it when absent.
      Parameters:
      directive - CSP directive name, lowercase
      sources - source expressions to append (duplicates are ignored)
      Returns:
      this

    • withoutSources

      public NextDashboardSecurityHeaders withoutSources(String directive, String... sources)
      Remove sources from a directive.
      Parameters:
      directive - CSP directive name, lowercase
      sources - source expressions to remove
      Returns:
      this

    • withoutDirective

      public NextDashboardSecurityHeaders withoutDirective(String directive)
      Remove a directive from the policy.
      Parameters:
      directive - CSP directive name, lowercase
      Returns:
      this

    • withHeader

      public NextDashboardSecurityHeaders withHeader(String name, String value)
      Set a response header sent with every dashboard file, or remove it.
      Parameters:
      name - header name, such as Referrer-Policy
      value - the value, or null to not send the header
      Returns:
      this

    • withContentSecurityPolicyEnabled

      public NextDashboardSecurityHeaders withContentSecurityPolicyEnabled(boolean enabled)
      Send the Content-Security-Policy (default) or not at all.
      Parameters:
      enabled - false to send no policy
      Returns:
      this

    • withReportOnly

      public NextDashboardSecurityHeaders withReportOnly(boolean reportOnly)
      Send the policy as Content-Security-Policy-Report-Only, for trying out a changed policy without enforcing it.
      Parameters:
      reportOnly - true to report violations instead of blocking
      Returns:
      this

    • getSources

      public Set<String> getSources(String directive)
      The sources of a directive, in order (empty when the directive is absent).

    • getHeaders

      public Map<String,String> getHeaders()
      The non-CSP headers, in order.

    • getContentSecurityPolicyHeaderName

      public String getContentSecurityPolicyHeaderName()
      Name of the policy header: Content-Security-Policy, the report-only variant, or null when the policy is disabled.

    • buildContentSecurityPolicy

      public String buildContentSecurityPolicy(Collection<String> scriptHashes)
      The policy for one document, with the hashes of its inline scripts added to script-src.
      Parameters:
      scriptHashes - source expressions such as 'sha256-...'
      Returns:
      the header value