forked from colin/resume
35 lines
1.2 KiB
JavaScript
35 lines
1.2 KiB
JavaScript
const express = require('express');
|
|
const path = require('path');
|
|
const app = express();
|
|
const port = 8080;
|
|
|
|
// Security headers middleware
|
|
app.use((req, res, next) => {
|
|
// Content Security Policy
|
|
res.setHeader(
|
|
'Content-Security-Policy',
|
|
"default-src 'self'; " +
|
|
"script-src 'self' 'unsafe-inline'; " +
|
|
"style-src 'self' 'unsafe-inline'; " +
|
|
"img-src 'self' data: https: http:; " +
|
|
"font-src 'self'; " +
|
|
"connect-src 'self'"
|
|
);
|
|
|
|
// Other security headers
|
|
res.setHeader('X-Content-Type-Options', 'nosniff');
|
|
res.setHeader('X-Frame-Options', 'DENY');
|
|
res.setHeader('X-XSS-Protection', '1; mode=block');
|
|
res.setHeader('Referrer-Policy', 'strict-origin-when-cross-origin');
|
|
res.setHeader('Permissions-Policy', 'geolocation=(), microphone=(), camera=()');
|
|
res.setHeader('Strict-Transport-Security', 'max-age=31536000; includeSubDomains');
|
|
|
|
next();
|
|
});
|
|
|
|
// Serve static files from the docker/resume directory
|
|
app.use(express.static(path.join(__dirname, '../docker/resume')));
|
|
|
|
app.listen(port, () => {
|
|
console.log(`Local development server running at http://localhost:${port}`);
|
|
});
|