feat: add CSP header (#908)

Co-authored-by: Alessandro (Ale) Segala <43508+ItalyPaleAle@users.noreply.github.com>

backend/frontend/frontend_included.go

@@ -3,8 +3,10 @@
 package frontend
 
 import (
+	"bytes"
 	"embed"
 	"fmt"
+	"io"
 	"io/fs"
 	"net/http"
 	"os"
@@ -12,11 +14,55 @@ import (
 	"time"
 
 	"github.com/gin-gonic/gin"
+	"github.com/pocket-id/pocket-id/backend/internal/middleware"
 )
 
 //go:embed all:dist/*
 var frontendFS embed.FS
 
+// This function, created by the init() method, writes to "w" the index.html page, populating the nonce
+var writeIndexFn func(w io.Writer, nonce string) error
+
+func init() {
+	const scriptTag = "<script>"
+
+	// Read the index.html from the bundle
+	index, iErr := fs.ReadFile(frontendFS, "dist/index.html")
+	if iErr != nil {
+		panic(fmt.Errorf("failed to read index.html: %w", iErr))
+	}
+
+	// Get the position of the first <script> tag
+	idx := bytes.Index(index, []byte(scriptTag))
+
+	// Create writeIndexFn, which adds the CSP tag to the script tag if needed
+	writeIndexFn = func(w io.Writer, nonce string) (err error) {
+		// If there's no nonce, write the index as-is
+		if nonce == "" {
+			_, err = w.Write(index)
+			return err
+		}
+
+		// We have a nonce, so first write the index until the <script> tag
+		// Then we write the modified script tag
+		// Finally, the rest of the index
+		_, err = w.Write(index[0:idx])
+		if err != nil {
+			return err
+		}
+		_, err = w.Write([]byte(`<script nonce="` + nonce + `">`))
+		if err != nil {
+			return err
+		}
+		_, err = w.Write(index[(idx + len(scriptTag)):])
+		if err != nil {
+			return err
+		}
+
+		return nil
+	}
+}
+
 func RegisterFrontend(router *gin.Engine) error {
 	distFS, err := fs.Sub(frontendFS, "dist")
 	if err != nil {
@@ -27,13 +73,39 @@ func RegisterFrontend(router *gin.Engine) error {
 	fileServer := NewFileServerWithCaching(http.FS(distFS), int(cacheMaxAge.Seconds()))
 
 	router.NoRoute(func(c *gin.Context) {
-		// Try to serve the requested file
 		path := strings.TrimPrefix(c.Request.URL.Path, "/")
-		if _, err := fs.Stat(distFS, path); os.IsNotExist(err) {
-			// File doesn't exist, serve index.html instead
-			c.Request.URL.Path = "/"
+
+		if strings.HasPrefix(path, "api/") {
+			c.JSON(http.StatusNotFound, gin.H{"error": "API endpoint not found"})
+			return
 		}
 
+		// If path is / or does not exist, serve index.html
+		if path == "" {
+			path = "index.html"
+		} else if _, err := fs.Stat(distFS, path); os.IsNotExist(err) {
+			path = "index.html"
+		}
+
+		if path == "index.html" {
+			nonce := middleware.GetCSPNonce(c)
+
+			// Do not cache the HTML shell, as it embeds a per-request nonce
+			c.Header("Content-Type", "text/html; charset=utf-8")
+			c.Header("Cache-Control", "no-store")
+			c.Status(http.StatusOK)
+
+			err = writeIndexFn(c.Writer, nonce)
+			if err != nil {
+				_ = c.Error(fmt.Errorf("failed to write index.html file: %w", err))
+				return
+			}
+
+			return
+		}
+
+		// Serve other static assets with caching
+		c.Request.URL.Path = "/" + path
 		fileServer.ServeHTTP(c.Writer, c.Request)
 	})