Yesod.Middleware.CSP

Deals with CSP without disabling it. This is done by overriding the default yesod provided addScript functionalities and adding a nonce to the tag, and the right headers to the request.

Documentation

data CombineSettings

Constructors

CombineSettings

Fields

• csStaticDir :: FilePath

  File path containing static files.

• csCssPostProcess :: [FilePath] -> ByteString -> IO ByteString

  Post processing to be performed on CSS files.

• csJsPostProcess :: [FilePath] -> ByteString -> IO ByteString

  Post processing to be performed on Javascript files.

• csCssPreProcess :: Text -> IO Text

  Pre-processing to be performed on CSS files.

• csJsPreProcess :: Text -> IO Text

  Pre-processing to be performed on Javascript files.

• csCombinedFolder :: FilePath

  Subfolder to put combined files into.

newtype CSPNonce

Constructors

CSPNonce

Fields

• unCSPNonce :: Text

Instances

Eq CSPNonce

Defined in Yesod.Middleware.CSP

Methods

(==) :: CSPNonce -> CSPNonce -> Bool

(/=) :: CSPNonce -> CSPNonce -> Bool

Ord CSPNonce

Defined in Yesod.Middleware.CSP

Methods

compare :: CSPNonce -> CSPNonce -> Ordering

(<) :: CSPNonce -> CSPNonce -> Bool

(<=) :: CSPNonce -> CSPNonce -> Bool

(>) :: CSPNonce -> CSPNonce -> Bool

(>=) :: CSPNonce -> CSPNonce -> Bool

max :: CSPNonce -> CSPNonce -> CSPNonce

min :: CSPNonce -> CSPNonce -> CSPNonce

data Directive

Constructors

DefaultSrc

StyleSrc

ScriptSrc

ObjectSrc

ImgSrc

FontSrc

ConnectSrc

MediaSrc

FrameSrc

FormAction

FrameAncestors

BaseURI

ReportURI

Instances

Eq Directive

Defined in Yesod.Middleware.CSP

Methods

(==) :: Directive -> Directive -> Bool

(/=) :: Directive -> Directive -> Bool

Ord Directive

Defined in Yesod.Middleware.CSP

Methods

compare :: Directive -> Directive -> Ordering

(<) :: Directive -> Directive -> Bool

(<=) :: Directive -> Directive -> Bool

(>) :: Directive -> Directive -> Bool

(>=) :: Directive -> Directive -> Bool

max :: Directive -> Directive -> Directive

min :: Directive -> Directive -> Directive

Show Directive

Defined in Yesod.Middleware.CSP

Methods

showsPrec :: Int -> Directive -> ShowS

show :: Directive -> String

showList :: [Directive] -> ShowS

data Source

Constructors

Wildcard

None

Self

DataScheme

BlobScheme

Host Text

Https

Http

UnsafeInline

UnsafeEval

StrictDynamic

Nonce Text

Instances

Eq Source

Defined in Yesod.Middleware.CSP

Methods

(==) :: Source -> Source -> Bool

(/=) :: Source -> Source -> Bool

Ord Source

Defined in Yesod.Middleware.CSP

Methods

compare :: Source -> Source -> Ordering

(<) :: Source -> Source -> Bool

(<=) :: Source -> Source -> Bool

(>) :: Source -> Source -> Bool

(>=) :: Source -> Source -> Bool

max :: Source -> Source -> Source

min :: Source -> Source -> Source

Show Source

Defined in Yesod.Middleware.CSP

Methods

showsPrec :: Int -> Source -> ShowS

show :: Source -> String

showList :: [Source] -> ShowS

IsString Source

Defined in Yesod.Middleware.CSP

Methods

fromString :: String -> Source

addCSP :: MonadWidget m => Directive -> Source -> m ()

Add a directive to the current Content-Security Policy

addCSPMiddleware :: HandlerFor m a -> HandlerFor m a

addScript :: MonadWidget m => Route (HandlerSite m) -> m ()

Add a local JavaScript asset to the widget

This is intended to a be a drop-in replacement for Yesod.Core.Widget.addScript. It takes the nonce generated for the current request and embeds it as an HTML attribute in the script tag.

addScriptEither :: MonadWidget m => Either (Route (HandlerSite m)) Text -> m ()

addScriptRemote :: MonadWidget m => Text -> m ()

Add a remote JavaScript asset to the widget

The same notes for addScript apply here.

combineScripts'

Arguments

:: Bool

development? if so, perform no combining

-> CombineSettings

-> Name

Static route constructor name, e.g. 'StaticR

-> [Route Static]

files to combine

-> Q Exp

Combine multiple JS files together

combineStylesheets'

Arguments

:: Bool

development? if so, perform no combining

-> CombineSettings

-> Name

Static route constructor name, e.g. 'StaticR

-> [Route Static]

files to combine

-> Q Exp

Combine multiple CSS files together

getRequestNonce :: MonadHandler m => m CSPNonce

Get a nonce for the request

CSP nonces must be unique per request, but they do not need to be unique amongst themselves. This function checks the per-request cache to see if we have already generated a nonce. If we have, we use the cached value. If this is the first call to this function for the request, we generate a new CSPNonce by base64-encoding a UUIDV4 value.

n.b. It is not important to use a high-quality random value to generate the nonce, but Data.UUID.V4.nextRandom just happens to be faster than System.Random.randomIO.