|
|
|
@ -30,16 +30,29 @@ class HttpServer { |
|
|
|
this.server = null |
|
|
|
|
|
|
|
// Initialize the tiny-http app
|
|
|
|
this.app = new App(); |
|
|
|
this.app.set('trust proxy', 'loopback') |
|
|
|
this.app = new App({ |
|
|
|
// Error handler
|
|
|
|
onError: (err, req, res) => { |
|
|
|
// Detect if this is auth error
|
|
|
|
if (Object.values(errors.auth).includes(err)) { |
|
|
|
HttpServer.sendError(res, err, 401) |
|
|
|
} else { |
|
|
|
Logger.error(err.stack, 'HttpServer : general error') |
|
|
|
const ret = {status: 'Server error'} |
|
|
|
HttpServer.sendError(res, ret, 500) |
|
|
|
} |
|
|
|
} |
|
|
|
}); |
|
|
|
|
|
|
|
// Middlewares for json responses and requests logging
|
|
|
|
this.app.use('/static', sirv('../static')); |
|
|
|
this.app.use(HttpServer.setJSONResponse) |
|
|
|
this.app.use(HttpServer.requestLogger) |
|
|
|
this.app.use(HttpServer.setCrossOrigin) |
|
|
|
this.app.use(HttpServer.setConnection) |
|
|
|
this.app.use(helmet(HttpServer.HELMET_POLICY)) |
|
|
|
|
|
|
|
this.app.use('/static', sirv('../static')); |
|
|
|
|
|
|
|
this.app.use(HttpServer.setJSONResponse) |
|
|
|
this.app.use(HttpServer.setConnection) |
|
|
|
} |
|
|
|
|
|
|
|
|
|
|
|
@ -48,14 +61,6 @@ class HttpServer { |
|
|
|
* @returns {object} returns the listening server instance |
|
|
|
*/ |
|
|
|
start() { |
|
|
|
// Error handler, should be final middleware
|
|
|
|
this.app.use(function(err, req, res, next) { |
|
|
|
if (res.headersSent) return next(err) |
|
|
|
Logger.error(err.stack, 'HttpServer : start()') |
|
|
|
const ret = {status: 'Server error'} |
|
|
|
HttpServer.sendError(res, ret, 500) |
|
|
|
}) |
|
|
|
|
|
|
|
// Start a http server
|
|
|
|
this.server = this.app.listen(this.port, this.host, () => { |
|
|
|
Logger.info(`HttpServer : Listening on ${this.host}:${this.port}`) |
|
|
|
@ -140,12 +145,10 @@ class HttpServer { |
|
|
|
|
|
|
|
/* |
|
|
|
* A middleware returning an authorization error response |
|
|
|
* @param {string} err - error |
|
|
|
* @param {object} req - http request object |
|
|
|
* @param {object} res - http response object |
|
|
|
* @param {function} next - callback function |
|
|
|
* @param {string} err - error |
|
|
|
*/ |
|
|
|
static sendAuthError(err, req, res, next) { |
|
|
|
static sendAuthError(res, err) { |
|
|
|
if (err) { |
|
|
|
HttpServer.sendError(res, err, 401) |
|
|
|
} |
|
|
|
@ -205,9 +208,15 @@ class HttpServer { |
|
|
|
HttpServer.HELMET_POLICY = { |
|
|
|
'contentSecurityPolicy' : { |
|
|
|
'directives': { |
|
|
|
'defaultSrc': ['"self"'], |
|
|
|
'styleSrc' : ['"self"', '"unsafe-inline"'], |
|
|
|
'img-src' : ['"self" data:'] |
|
|
|
'default-src': ["'self'", "data:"], |
|
|
|
'base-uri': ["'self'"], |
|
|
|
'font-src': ["'self'", "https:", "data:"], |
|
|
|
'frame-ancestors': ["'self'"], |
|
|
|
'img-src': ["'self'", "data:"], |
|
|
|
'object-src': ["'none'"], |
|
|
|
'script-src': ["'self'", "'unsafe-inline'"], |
|
|
|
'style-src': ["'self'", "https:", "'unsafe-inline'"], |
|
|
|
'media-src': ["'self'", 'data:'], |
|
|
|
}, |
|
|
|
'browserSniff': false, |
|
|
|
'disableAndroid': true |
|
|
|
|
Pavel Ševčík
4 years ago