yesod-middleware-csp-1.0.0: A middleware for building CSP headers on the fly
Safe HaskellNone
LanguageHaskell2010

Yesod.Middleware.CSP

Description

Deals with CSP without disabling it. This is done by overriding the default yesod provided addScript functionalities and adding a nonce to the tag, and the right headers to the request.

Synopsis

Documentation

data CombineSettings Source #

Constructors

CombineSettings 

Fields

newtype CSPNonce Source #

Constructors

CSPNonce 

Fields

Instances

Instances details
Eq CSPNonce Source # 
Instance details

Defined in Yesod.Middleware.CSP

Ord CSPNonce Source # 
Instance details

Defined in Yesod.Middleware.CSP

data Source Source #

Instances

Instances details
Eq Source Source # 
Instance details

Defined in Yesod.Middleware.CSP

Methods

(==) :: Source -> Source -> Bool #

(/=) :: Source -> Source -> Bool #

Ord Source Source # 
Instance details

Defined in Yesod.Middleware.CSP

Show Source Source # 
Instance details

Defined in Yesod.Middleware.CSP

IsString Source Source # 
Instance details

Defined in Yesod.Middleware.CSP

Methods

fromString :: String -> Source #

addCSP :: MonadWidget m => Directive -> Source -> m () Source #

Add a directive to the current Content-Security Policy

addScript :: MonadWidget m => Route (HandlerSite m) -> m () Source #

Add a local JavaScript asset to the widget

This is intended to a be a drop-in replacement for Yesod.Core.Widget.addScript. It takes the nonce generated for the current request and embeds it as an HTML attribute in the script tag.

addScriptRemote :: MonadWidget m => Text -> m () Source #

Add a remote JavaScript asset to the widget

The same notes for addScript apply here.

combineScripts' Source #

Arguments

:: Bool

development? if so, perform no combining

-> CombineSettings 
-> Name

Static route constructor name, e.g. 'StaticR

-> [Route Static]

files to combine

-> Q Exp 

Combine multiple JS files together

combineStylesheets' Source #

Arguments

:: Bool

development? if so, perform no combining

-> CombineSettings 
-> Name

Static route constructor name, e.g. 'StaticR

-> [Route Static]

files to combine

-> Q Exp 

Combine multiple CSS files together

getRequestNonce :: MonadHandler m => m CSPNonce Source #

Get a nonce for the request

CSP nonces must be unique per request, but they do not need to be unique amongst themselves. This function checks the per-request cache to see if we have already generated a nonce. If we have, we use the cached value. If this is the first call to this function for the request, we generate a new CSPNonce by base64-encoding a UUIDV4 value.

n.b. It is not important to use a high-quality random value to generate the nonce, but Data.UUID.V4.nextRandom just happens to be faster than System.Random.randomIO.