fetchmetadata

Documentation

Overview

Package fetchmetadata provides Fetch-Metadata based protections.

Index

• type Policy
  • func FramingIsolationPolicy() *Policy
  • func ResourceIsolationPolicy() *Policy
  • func (p *Policy) Before(w safehttp.ResponseWriter, r *safehttp.IncomingRequest, ...) safehttp.Result
  • func (p *Policy) Commit(w safehttp.ResponseHeadersWriter, r *safehttp.IncomingRequest, ...)
  • func (p *Policy) Match(cfg safehttp.InterceptorConfig) bool

Types

type Policy

type Policy struct {
	ReportOnly bool
	// contains filtered or unexported fields
}

Policy is a security policy based on Fetch Metadata.

See https://web.dev/fetch-metadata/ for more.

func FramingIsolationPolicy

func FramingIsolationPolicy() *Policy

FramingIsolationPolicy protects from framing attacks.

See https://xsleaks.dev/docs/defenses/isolation-policies/framing-isolation/#implementation-with-fetch-metadata

func ResourceIsolationPolicy

func ResourceIsolationPolicy() *Policy

ResourceIsolationPolicy protects resources.

See https://web.dev/fetch-metadata/ for more details.

func (*Policy) Before

func (p *Policy) Before(w safehttp.ResponseWriter, r *safehttp.IncomingRequest, cfg safehttp.InterceptorConfig) safehttp.Result

Before implements the Fetch Metadata validation and signals logic.

func (*Policy) Commit

func (p *Policy) Commit(w safehttp.ResponseHeadersWriter, r *safehttp.IncomingRequest, resp safehttp.Response, _ safehttp.InterceptorConfig)

Commit is a no-op, required to satisfy the safehttp.Interceptor interface.

func (*Policy) Match

func (p *Policy) Match(cfg safehttp.InterceptorConfig) bool

Match recongnizes configs to disable fetch metadata protection.