security.hpp

Go to the documentation of this file.

//*************************************************************************
// File security.hpp
// Date 07.05.2018 - #1
// Copyright (c) 2018-2018 by Patrick Fial
//-------------------------------------------------------------------------
// Security functions
// Middleware that sets a crapload of security related HTTP headers
//*************************************************************************

#ifndef __SECURITY_HPP__
#define __SECURITY_HPP__

//***************************************************************************
// includes
//***************************************************************************

#include <string>
#include <core.hpp>

namespace cex
{

//**************************************************************************
// Middlewares
//***************************************************************************
// Security
//***************************************************************************

enum XFrame
{
   xfUnknown= na,

   xfDeny,
   xfSameOrigin,
   xfFrom
};

enum Referer
{
   refUnknown= na,

   refNoReferrer,
   refNoReferrerWhenDowngrade,
   refSameOrigin,
   refOrigin,
   refStrictOrigin,
   refOriginWhenCrossOrigin,
   refStrictOriginWhenCrossOrigin,
   refUnsafeUrl
};

struct SecurityOptions
{
   SecurityOptions();

   int noDNSPrefetch;  
   bool ieNoOpen;      
   bool disableCache;  
   bool noSniff;       
   int referrer;       
   bool xssProtection; 
   // X-Frame-Options

   XFrame xFrameAllow; 
   std::string xFrameFrom; 
   // Strict Transport Security

   int stsMaxAge;             
   bool stsIncludeSubDomains; 
   bool stsPreload;           
   // HTTP Public Key Pinning

   int hpkpMaxAge;                     
   std::vector<std::string> hpkpKeys;  
   bool hpkpIncludeSubDomains;         
   std::string hpkpReportUri;          
};

MiddlewareFunction securityHeaders(std::shared_ptr<SecurityOptions> opts= nullptr);

//***************************************************************************
} // namespace cex

#endif // __SECURITY_HPP_