Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 5 additions & 5 deletions secure.go
Original file line number Diff line number Diff line change
Expand Up @@ -122,9 +122,9 @@ type Config struct {
XFrameOptions string
}

// DefaultSecureConfig is the default Secure middleware config.
// DefaultConfig is the default middleware config.
// It provides a secure baseline for web applications but may need customization for specific requirements.
var DefaultSecureConfig = Config{
var DefaultConfig = Config{
Skipper: middleware.DefaultSkipper,
ContentSecurityPolicy: "default-src 'none'; script-src 'self'; connect-src 'self'; img-src 'self'; style-src 'self'; base-uri 'self'; form-action 'self';",
CrossOriginEmbedderPolicy: "require-corp",
Expand All @@ -143,15 +143,15 @@ var DefaultSecureConfig = Config{

// New returns a middleware with optional custom configuration.
// This middleware adds various security-related HTTP headers to each response.
// If no configuration is provided, it uses DefaultSecureConfig.
// If no configuration is provided, it uses DefaultConfig.
func New(config ...Config) echo.MiddlewareFunc {
cfg := DefaultSecureConfig
cfg := DefaultConfig
if len(config) > 0 {
cfg = config[0]
}

if cfg.Skipper == nil {
cfg.Skipper = DefaultSecureConfig.Skipper
cfg.Skipper = DefaultConfig.Skipper
}

return func(next echo.HandlerFunc) echo.HandlerFunc {
Expand Down
18 changes: 9 additions & 9 deletions secure_test.go
Original file line number Diff line number Diff line change
Expand Up @@ -26,7 +26,7 @@ func TestNewWithConfig(t *testing.T) {
}{
{
name: "Default config",
config: DefaultSecureConfig,
config: DefaultConfig,
expected: map[string]string{
echo.HeaderContentSecurityPolicy: "default-src 'none'; script-src 'self'; connect-src 'self'; img-src 'self'; style-src 'self'; base-uri 'self'; form-action 'self';",
HeaderCrossOriginEmbedderPolicy: "require-corp",
Expand Down Expand Up @@ -177,12 +177,12 @@ func TestNew(t *testing.T) {

assert.NoError(t, err)

assert.Equal(t, DefaultSecureConfig.ContentSecurityPolicy, rec.Header().Get(echo.HeaderContentSecurityPolicy))
assert.Equal(t, DefaultSecureConfig.CrossOriginEmbedderPolicy, rec.Header().Get(HeaderCrossOriginEmbedderPolicy))
assert.Equal(t, DefaultSecureConfig.CrossOriginOpenerPolicy, rec.Header().Get(HeaderCrossOriginOpenerPolicy))
assert.Equal(t, DefaultSecureConfig.CrossOriginResourcePolicy, rec.Header().Get(HeaderCrossOriginResourcePolicy))
assert.Equal(t, DefaultSecureConfig.PermissionsPolicy, rec.Header().Get(HeaderPermissionsPolicy))
assert.Equal(t, DefaultSecureConfig.ReferrerPolicy, rec.Header().Get(echo.HeaderReferrerPolicy))
assert.Equal(t, DefaultSecureConfig.XContentTypeOptions, rec.Header().Get(echo.HeaderXContentTypeOptions))
assert.Equal(t, DefaultSecureConfig.XFrameOptions, rec.Header().Get(echo.HeaderXFrameOptions))
assert.Equal(t, DefaultConfig.ContentSecurityPolicy, rec.Header().Get(echo.HeaderContentSecurityPolicy))
assert.Equal(t, DefaultConfig.CrossOriginEmbedderPolicy, rec.Header().Get(HeaderCrossOriginEmbedderPolicy))
assert.Equal(t, DefaultConfig.CrossOriginOpenerPolicy, rec.Header().Get(HeaderCrossOriginOpenerPolicy))
assert.Equal(t, DefaultConfig.CrossOriginResourcePolicy, rec.Header().Get(HeaderCrossOriginResourcePolicy))
assert.Equal(t, DefaultConfig.PermissionsPolicy, rec.Header().Get(HeaderPermissionsPolicy))
assert.Equal(t, DefaultConfig.ReferrerPolicy, rec.Header().Get(echo.HeaderReferrerPolicy))
assert.Equal(t, DefaultConfig.XContentTypeOptions, rec.Header().Get(echo.HeaderXContentTypeOptions))
assert.Equal(t, DefaultConfig.XFrameOptions, rec.Header().Get(echo.HeaderXFrameOptions))
}
Loading