Skip to content

Commit 05e9e46

Browse files
ProgrameerikProgrameerik
committed
Added csp header to fix security issues. Now the scripts of only defined websites can be used. And I've removed all inline styling.
1 parent 43cb572 commit 05e9e46

File tree

9 files changed

+90
-43
lines changed

9 files changed

+90
-43
lines changed

‎ShowcaseProject/ShowcaseAPI/Dockerfile‎

Lines changed: 6 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -1,41 +1,20 @@
1-
# Base image for running the .NET API
2-
FROM mcr.microsoft.com/dotnet/aspnet:8.0 AS base
3-
WORKDIR /app
41
EXPOSE 8080
52
EXPOSE 8081
6-
7-
# Development stage (voor dotnet watch)
83
FROM mcr.microsoft.com/dotnet/sdk:8.0 AS dev
94
WORKDIR /app
5+
106
COPY ./ShowcaseAPI ./ShowcaseAPI
117
WORKDIR /app/ShowcaseAPI
128
CMD ["dotnet", "watch", "run", "--no-launch-profile", "--urls", "http://+:80"]
139

14-
# Build stage (voor productie)
1510
FROM mcr.microsoft.com/dotnet/sdk:8.0 AS build
1611
WORKDIR /src
17-
COPY ["ShowcaseAPI/ShowcaseAPI.csproj", "ShowcaseAPI/"]
18-
RUN dotnet restore "ShowcaseAPI/ShowcaseAPI.csproj"
19-
20-
# Copy and build source
2112
COPY . .
22-
WORKDIR "/src/ShowcaseAPI"
23-
RUN dotnet build "ShowcaseAPI.csproj" -c Release -o /app/build
13+
RUN dotnet restore ./ShowcaseAPI/ShowcaseAPI.csproj
14+
WORKDIR /src/ShowcaseAPI
15+
RUN dotnet publish -c Release -o /app/publish /p:UseAppHost=false
2416

25-
# Publish (voor productie)
26-
FROM build AS publish
27-
RUN dotnet publish "ShowcaseAPI.csproj" -c Release -o /app/publish /p:UseAppHost=false
28-
29-
# Final production stage
3017
FROM mcr.microsoft.com/dotnet/aspnet:8.0 AS final
3118
WORKDIR /app
32-
33-
# Kopieer wait script
34-
COPY ShowcaseAPI/wait-for-sql.sh .
35-
RUN chmod +x wait-for-sql.sh
36-
37-
# Kopieer build output
38-
COPY --from=publish /app/publish .
39-
40-
# Start script dat wacht op SQL Server
41-
ENTRYPOINT ["./wait-for-sql.sh"]
19+
COPY --from=build /app/publish .
20+
ENTRYPOINT ["dotnet", "ShowcaseAPI.dll"]

‎ShowcaseProject/ShowcaseAPI/Program.cs‎

Lines changed: 21 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@
1111

1212
builder.Services.AddCors(options =>
1313
{
14-
options.AddPolicy("AllowFrontend",
14+
options.AddPolicy("AllowFrontendDevelopment",
1515
policy =>
1616
{
1717
policy.WithOrigins("http://localhost:8080")
@@ -20,7 +20,19 @@
2020
.AllowCredentials();
2121
});
2222
});
23-
23+
24+
builder.Services.AddCors(options =>
25+
{
26+
options.AddPolicy("AllowFrontendProduction",
27+
policy =>
28+
{
29+
policy.WithOrigins("https://showcaseapi-demo123.eastus.azurecontainer.io")
30+
.AllowAnyHeader()
31+
.AllowAnyMethod()
32+
.AllowCredentials();
33+
});
34+
});
35+
2436
Env.Load();
2537

2638
// Add services to the container.
@@ -73,8 +85,14 @@
7385
{
7486
app.UseHttpsRedirection();
7587
}
88+
if (app.Environment.IsDevelopment())
89+
{
90+
app.UseCors("AllowFrontendDevelopment");
91+
}else
92+
{
93+
app.UseCors("AllowFrontendProduction");
7694

77-
app.UseCors("AllowFrontend");
95+
}
7896

7997
app.MapHub<GameHub>("/hub/game");
8098

‎ShowcaseProject/ShowcaseFrontend/Dockerfile‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,11 @@
1+
EXPOSE 8080
2+
EXPOSE 8081
13
FROM mcr.microsoft.com/dotnet/sdk:8.0 AS dev
24
WORKDIR /app
35

4-
COPY . .
5-
RUN dotnet restore ./ShowcaseFrontend//ShowcaseFrontend.csproj
6+
7+
#COPY . .
8+
#RUN dotnet restore ./ShowcaseFrontend//ShowcaseFrontend.csproj
69

710
COPY ShowcaseFrontend/. ShowcaseFrontend/
811
WORKDIR /app/ShowcaseFrontend

‎ShowcaseProject/ShowcaseFrontend/Program.cs‎

Lines changed: 15 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,21 @@
4040
// The default HSTS value is 30 days. You may want to change this for production scenarios, see https://aka.ms/aspnetcore-hsts.
4141
app.UseHsts();
4242
}
43-
43+
app.Use(async (context, next) =>
44+
{
45+
context.Response.Headers.Append("Content-Security-Policy",
46+
"default-src 'self'; " +
47+
"script-src 'self' https://cdnjs.cloudflare.com ; " +
48+
"style-src 'self' 'sha256-xyz4zkCjuC3lZcD2UmnqDG0vurmq12W/XKM5Vd0+MlQ='; " +
49+
"font-src 'self' ; " +
50+
"img-src 'self'; " +
51+
"object-src 'none'; " +
52+
"frame-ancestors 'none'; " +
53+
"base-uri 'self'; " +
54+
"form-action 'self';"+
55+
"connect-src 'self' ws://localhost:* http://localhost:5001 https://cdnjs.cloudflare.com/ajax/libs/microsoft-signalr/6.0.1/signalr.js.map; ");
56+
await next();
57+
});
4458
if (!app.Environment.IsDevelopment())
4559
{
4660
app.UseHttpsRedirection();

‎ShowcaseProject/ShowcaseFrontend/Views/Game/Index.cshtml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,9 +17,9 @@
1717
<input type="submit" name="submit" value="Create Game" />
1818
</form>
1919

20-
<button id="StartGame" style="display: none;">Start Game</button>
20+
<button id="StartGame" class="hide-game-element">Start Game</button>
2121

22-
<div id="GameBoard" style="display: none;">
22+
<div id="GameBoard" class="hide-game-element">
2323

2424
</div>
2525

‎ShowcaseProject/ShowcaseFrontend/Views/Shared/_Layout.cshtml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
<!DOCTYPE html>
2-
<html lang="en">
2+
<html lang="nl-nl">
33
<head>
44
<meta charset="utf-8" />
55
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
@@ -9,6 +9,7 @@
99
<link rel="stylesheet" href="~/css/gdpr.css" asp-append-version="true" />
1010
<link rel="stylesheet" href="~/css/profilepage.css" asp-append-version="true" />
1111
<link rel="stylesheet" href="~/css/contactpage.css" asp-append-version="true" />
12+
<link rel="stylesheet" href="~/css/game.css" asp-append-version="true" />
1213
</head>
1314
<body>
1415
<header>

‎ShowcaseProject/ShowcaseFrontend/wwwroot/css/game.css‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
.hide-game-element {
2+
display: none;
3+
}
4+
5+
#GameBoard {
6+
display: grid;
7+
width: 150px;
8+
grid-template-columns: auto auto auto;
9+
gap: 5px 5px;
10+
}
11+
12+
#GameBoard div {
13+
border:solid #333333 1px;
14+
width:50px;
15+
height:50px;
16+
}
17+
18+
#display-block {
19+
display: block;
20+
}
21+
22+
#GameEndPopUp {
23+
z-index: 10;
24+
width: 50%;
25+
position: absolute;
26+
top: 20%;
27+
left: 25%;
28+
background: #333333;
29+
opacity: 0.7;
30+
color: white;
31+
text-align: center;
32+
padding: 1rem;
33+
}

‎ShowcaseProject/ShowcaseFrontend/wwwroot/js/game.js‎

Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -53,7 +53,7 @@
5353
groupNameElement.innerHTML = groupName;
5454
createUserListElements(userIds);
5555
if (userIds.length >= 2) {
56-
btnStartGame.setAttribute("style", "display:block;");
56+
btnStartGame.classList.remove("hide-game-element");
5757
}
5858
});
5959

@@ -62,14 +62,14 @@
6262
groupNameElement.innerHTML = groupName;
6363
createUserListElements(userIds);
6464
if (userIds.length >= 2) {
65-
btnStartGame.setAttribute("style", "display:block;");
65+
btnStartGame.classList.remove("hide-game-element");
6666
}
6767
});
6868

6969
await connection.on("ShowUserList", (userIds) => {
7070
createUserListElements(userIds);
7171
if (userIds.length >= 2) {
72-
btnStartGame.setAttribute("style", "display:block;");
72+
btnStartGame.classList.remove("hide-game-element");
7373
}
7474
});
7575

@@ -132,11 +132,11 @@
132132

133133
async function createGameBoard(groupName,playerSymbol) {
134134
const board = document.querySelector("#GameBoard");
135-
board.setAttribute("style", "display:grid;width: 150px;grid-template-columns: auto auto auto;gap: 5px 5px;");
135+
//board.setAttribute("style", "display:grid;width: 150px;grid-template-columns: auto auto auto;gap: 5px 5px;");
136136
for (let i = 0; i < 9; i++) {
137137
let span = document.createElement("div");
138138
span.innerHTML = " ";
139-
span.style = "border:solid;#333333;1px;width:50px;height:50px;";
139+
//span.style = "border:solid;#333333;1px;width:50px;height:50px;";
140140
span.id = "cell" + i;
141141
span.onclick = async () => {
142142
let cell = document.getElementById("cell" + i);
@@ -171,7 +171,6 @@
171171
const popup = document.createElement("div");
172172
popup.id = "GameEndPopUp";
173173
popup.innerHTML = message;
174-
popup.style = "z-index: 10;width: 50%;position: absolute;top: 20%;left: 25%;background: #333333;opacity: 0.7;color: white;text-align: center;padding: 1rem;"
175174

176175
const button = document.createElement("button");
177176
button.onclick = () => {

‎ShowcaseProject/docker-compose.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ services:
1616
build:
1717
context: .
1818
dockerfile: ShowcaseFrontend/Dockerfile
19-
target: dev
19+
target: "dev"
2020
container_name: showcasefrontend
2121
ports:
2222
- "8080:80"

0 commit comments

Comments
 (0)