From 890df798ce003fd90a84a438dbb3104b8b8937ba Mon Sep 17 00:00:00 2001 From: Dylan Hildenbrand Date: Thu, 17 Jul 2025 14:47:44 -0500 Subject: [PATCH 1/4] testing headers --- _headers | 6 ++++++ src/hooks.server.ts | 18 ++++++++++++++++++ 2 files changed, 24 insertions(+) create mode 100644 src/hooks.server.ts diff --git a/_headers b/_headers index aab67718..f9660253 100644 --- a/_headers +++ b/_headers @@ -1,2 +1,8 @@ /* X-Frame-Options: DENY + X-XSS-Protection: 0 + X-Content-Type-Options: nosniff + Referrer-Policy: strict-origin-when-cross-origin + Strict-Transport-Security: text/html; charset=UTF-8 + Content-Type: text/html: charset=UTF-8 + Content-Security-Policy: default-src 'self'; script-src 'self' static.cloudflareinsights.com diff --git a/src/hooks.server.ts b/src/hooks.server.ts new file mode 100644 index 00000000..6b5205c5 --- /dev/null +++ b/src/hooks.server.ts @@ -0,0 +1,18 @@ +import type { Handle } from '@sveltejs/kit'; + +export const handle: Handle = async ({ event, resolve }) => { + const response = await resolve(event); + response.headers.set('X-Frame-Options', 'DENY'); + response.headers.set('X-XSS-Protection', '0'); + response.headers.set('X-Content-Type-Options', 'nosniff'); + response.headers.set('Referrer-Policy', 'strict-origin-when-cross-origin'); + response.headers.set('Strict-Transport-Security', 'text/html; charset=UTF-8'); + response.headers.set('Content-Type', 'text/html; charset=UTF-8'); + + response.headers.set( + 'Content-Security-Policy', + "default-src 'self'; script-src 'self' static.cloudflareinsights.com" + ); + + return response; +}; From 51c3fcc9ef77f8c00802c17ad6d6e6e3d1cfd11c Mon Sep 17 00:00:00 2001 From: Dylan Hildenbrand Date: Thu, 17 Jul 2025 21:08:51 -0500 Subject: [PATCH 2/4] testing sveltekit csp config --- src/hooks.server.ts | 8 ++++---- src/routes/+layout.ts | 2 -- svelte.config.js | 24 ++++++++++++++---------- 3 files changed, 18 insertions(+), 16 deletions(-) diff --git a/src/hooks.server.ts b/src/hooks.server.ts index 6b5205c5..66f6b94f 100644 --- a/src/hooks.server.ts +++ b/src/hooks.server.ts @@ -9,10 +9,10 @@ export const handle: Handle = async ({ event, resolve }) => { response.headers.set('Strict-Transport-Security', 'text/html; charset=UTF-8'); response.headers.set('Content-Type', 'text/html; charset=UTF-8'); - response.headers.set( - 'Content-Security-Policy', - "default-src 'self'; script-src 'self' static.cloudflareinsights.com" - ); + // response.headers.set( + // 'Content-Security-Policy', + // "default-src 'self'; script-src 'self' static.cloudflareinsights.com;" + // ); return response; }; diff --git a/src/routes/+layout.ts b/src/routes/+layout.ts index b1a5670a..189f71e2 100644 --- a/src/routes/+layout.ts +++ b/src/routes/+layout.ts @@ -1,3 +1 @@ export const prerender = true; -export const ssr = false; -export const csr = true; diff --git a/svelte.config.js b/svelte.config.js index 800310f7..e37aa3e3 100644 --- a/svelte.config.js +++ b/svelte.config.js @@ -3,20 +3,24 @@ import { vitePreprocess } from '@sveltejs/vite-plugin-svelte'; /** @type {import('@sveltejs/kit').Config} */ const config = { - kit: { - adapter: adapter({ - fallback: '200.html', + kit: { + adapter: adapter({ + fallback: '200.html', routes: { include: ['/*'], exclude: [''] } - }), - alias: { - '$utils': 'src/utils/', - '$stores': 'src/stores/' - } - }, - preprocess: vitePreprocess() + }), + alias: { + $utils: 'src/utils/', + $stores: 'src/stores/' + }, + csp: { + mode: 'auto', + directives: { 'script-src': ['self', 'static.cloudflareinsights.com'] } + } + }, + preprocess: vitePreprocess() }; export default config; From 48860dc388a2af997fd336e60cc14f1221a4f23e Mon Sep 17 00:00:00 2001 From: Dylan Hildenbrand Date: Thu, 17 Jul 2025 21:14:08 -0500 Subject: [PATCH 3/4] removing ssr --- src/routes/+layout.ts | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/routes/+layout.ts b/src/routes/+layout.ts index 189f71e2..b1a5670a 100644 --- a/src/routes/+layout.ts +++ b/src/routes/+layout.ts @@ -1 +1,3 @@ export const prerender = true; +export const ssr = false; +export const csr = true; From e61a393d720205538d404947afa4f3e1ad0afba0 Mon Sep 17 00:00:00 2001 From: Dylan Hildenbrand Date: Tue, 22 Jul 2025 13:38:03 -0500 Subject: [PATCH 4/4] To get headers working properly, I may need to generate them during the build step. --- src/hooks.server.ts | 18 ------------------ svelte.config.js | 4 ---- 2 files changed, 22 deletions(-) delete mode 100644 src/hooks.server.ts diff --git a/src/hooks.server.ts b/src/hooks.server.ts deleted file mode 100644 index 66f6b94f..00000000 --- a/src/hooks.server.ts +++ /dev/null @@ -1,18 +0,0 @@ -import type { Handle } from '@sveltejs/kit'; - -export const handle: Handle = async ({ event, resolve }) => { - const response = await resolve(event); - response.headers.set('X-Frame-Options', 'DENY'); - response.headers.set('X-XSS-Protection', '0'); - response.headers.set('X-Content-Type-Options', 'nosniff'); - response.headers.set('Referrer-Policy', 'strict-origin-when-cross-origin'); - response.headers.set('Strict-Transport-Security', 'text/html; charset=UTF-8'); - response.headers.set('Content-Type', 'text/html; charset=UTF-8'); - - // response.headers.set( - // 'Content-Security-Policy', - // "default-src 'self'; script-src 'self' static.cloudflareinsights.com;" - // ); - - return response; -}; diff --git a/svelte.config.js b/svelte.config.js index e37aa3e3..459ac84e 100644 --- a/svelte.config.js +++ b/svelte.config.js @@ -14,10 +14,6 @@ const config = { alias: { $utils: 'src/utils/', $stores: 'src/stores/' - }, - csp: { - mode: 'auto', - directives: { 'script-src': ['self', 'static.cloudflareinsights.com'] } } }, preprocess: vitePreprocess()