jochen
7e83b99615
ADR 0515 §6: /static/app.js and /static/app.css are built in and served with their types and nosniff; the policy allows script and style from the origin alone and connect-src 'self'; no page carries an inline script, a style or a handler. The script posts the page's forms without a reload and says a failure on the page.
38 lines
1.1 KiB
Go
38 lines
1.1 KiB
Go
package web
|
|
|
|
// The mail page's one script and one stylesheet (novox/hq ADR 0515 §6, issue 1859), built into the binary and
|
|
// served from the page's own origin at /static/app.js and /static/app.css, with their types and nosniff;
|
|
// nothing else is served from /static/. Neither carries anything of a mail.
|
|
|
|
import (
|
|
"embed"
|
|
"net/http"
|
|
)
|
|
|
|
//go:embed static/app.js static/app.css
|
|
var staticFiles embed.FS
|
|
|
|
// staticTypes are the two files and their types.
|
|
var staticTypes = map[string]string{
|
|
"/static/app.js": "text/javascript; charset=utf-8",
|
|
"/static/app.css": "text/css; charset=utf-8",
|
|
}
|
|
|
|
// staticPage answers /static/app.js and /static/app.css; anything else under /static/ is 404.
|
|
func staticPage(w http.ResponseWriter, r *http.Request) {
|
|
typ, ok := staticTypes[r.URL.Path]
|
|
if !ok || (r.Method != http.MethodGet && r.Method != http.MethodHead) {
|
|
http.NotFound(w, r)
|
|
return
|
|
}
|
|
body, err := staticFiles.ReadFile(r.URL.Path[1:])
|
|
if err != nil {
|
|
http.NotFound(w, r)
|
|
return
|
|
}
|
|
w.Header().Set("Content-Type", typ)
|
|
w.Header().Set("X-Content-Type-Options", "nosniff")
|
|
w.Header().Set("Cache-Control", "no-cache")
|
|
_, _ = w.Write(body)
|
|
}
|