Elijah/drive
Archived
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Onlyoffice fixes
All checks were successful
Automated Container Build / build-and-push (push) Successful in 1m27s
Details

Browse source
This commit is contained in:
Elijah Kuntz 2026-06-11 11:17:59 -07:00
parent e79f2fbbd5
commit c8ea7f3d88
1 changed files with 14 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

16
backend/main.go
View file

@ -103,9 +103,21 @@ func main() {
c.Set("Cache-Control", "no-store, no-cache, must-revalidate") c.Set("Cache-Control", "no-store, no-cache, must-revalidate")
return c.Next() return c.Next()
}) })
app.Use(helmet.New()) app.Use(helmet.New(helmet.Config{
// Relax cross-origin policies to allow OnlyOffice Document Server
// iframe embedding from a different origin (e.g. office.elijahkuntz.com)
CrossOriginEmbedderPolicy: "unsafe-none",
CrossOriginResourcePolicy: "cross-origin",
}))
// Build CSP with dynamic frame-src for the OnlyOffice Document Server
onlyOfficeFrameSrc := "https://" + cfg.OnlyOfficeHost
cspHeader := fmt.Sprintf(
"default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; connect-src 'self' wss: https: http:; frame-src 'self' %s;",
onlyOfficeFrameSrc,
)
app.Use(func(c *fiber.Ctx) error { app.Use(func(c *fiber.Ctx) error {
c.Set("Content-Security-Policy", "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; connect-src 'self' wss: https: http:;") c.Set("Content-Security-Policy", cspHeader)
return c.Next() return c.Next()
}) })
allowedOrigins := os.Getenv("ALLOWED_ORIGINS") allowedOrigins := os.Getenv("ALLOWED_ORIGINS")