[UPDATE-CONFIG] Use 3 hosts www, secure and static.

[gigi.git] / src / org / cacert / gigi / Gigi.java

diff --git a/src/org/cacert/gigi/Gigi.java b/src/org/cacert/gigi/Gigi.java
index 540433580e9c11a6a27b6c7a3f68cc9ac7c0a7dc..fa259c96c77cbf99835c8df72e374c863935bd3e 100644 (file)
--- a/src/org/cacert/gigi/Gigi.java
+++ b/src/org/cacert/gigi/Gigi.java
@@ -20,7 +20,6 @@ import org.cacert.gigi.email.EmailProvider;
 import org.cacert.gigi.pages.LoginPage;
 import org.cacert.gigi.pages.MainPage;
 import org.cacert.gigi.pages.Page;
-import org.cacert.gigi.pages.PolicyRedir;
 import org.cacert.gigi.pages.TestSecure;
 import org.cacert.gigi.pages.Verify;
 import org.cacert.gigi.pages.account.MailAdd;
@@ -29,6 +28,7 @@ import org.cacert.gigi.pages.account.MailOverview;
 import org.cacert.gigi.pages.account.MyDetails;
 import org.cacert.gigi.pages.main.RegisterPage;
 import org.cacert.gigi.pages.wot.AssurePage;
+import org.cacert.gigi.util.ServerConstants;
 import org.eclipse.jetty.util.log.Log;
 
 public class Gigi extends HttpServlet {
@@ -52,7 +52,6 @@ public class Gigi extends HttpServlet {
                pages.put(MailCertificates.PATH, new MailCertificates());
                pages.put(MyDetails.PATH, new MyDetails());
                pages.put(RegisterPage.PATH, new RegisterPage());
-               pages.put(PolicyRedir.PATH, new PolicyRedir());
                pages.put(MailOverview.DEFAULT_PATH, new MailOverview(
                                "My email addresses"));
                pages.put(MailAdd.DEFAULT_PATH, new MailAdd("Add new email"));
@@ -73,6 +72,11 @@ public class Gigi extends HttpServlet {
        @Override
        protected void service(HttpServletRequest req, HttpServletResponse resp)
                        throws ServletException, IOException {
+               addXSSHeaders(resp);
+               if (req.getHeader("Origin") != null) {
+                       resp.getWriter().println("No cross domain access allowed.");
+                       return;
+               }
                HttpSession hs = req.getSession();
                if (req.getPathInfo() != null && req.getPathInfo().equals("/logout")) {
                        if (hs != null) {
@@ -142,5 +146,14 @@ public class Gigi extends HttpServlet {
                in = in.replaceAll("\\$year\\$", year + "");
                return in;
        }
+       public static void addXSSHeaders(HttpServletResponse hsr) {
+               hsr.addHeader("Access-Control-Allow-Origin",
+                               "http://cacert.org https://localhost");
+               hsr.addHeader("Access-Control-Max-Age", "60");
+               hsr.addHeader("Content-Security-Policy", "default-src 'self' https://"
+                               + ServerConstants.getStaticHostNamePort()
+                               + " https://www.cacert.org/*;frame-ancestors 'none'");
+               // ;report-uri https://felix.dogcraft.de/report.php
 
+       }
 }