my own indieAuth provider!
indiko.dunkirk.sh/docs
indieauth
oauth2-server
feat: add csp headers
+68
+68
README.md
+68
README.md
···
129
129
- `PUT /api/admin/clients/:clientId` - Update client
130
130
- `DELETE /api/admin/clients/:clientId` - Delete client
131
131
132
+
## Production Deployment
133
+
134
+
### Reverse Proxy Configuration
135
+
136
+
Indiko should be deployed behind a reverse proxy (nginx, Caddy, Traefik) for production use. The proxy should add security headers.
137
+
138
+
#### nginx Example
139
+
140
+
```nginx
141
+
server {
142
+
listen 443 ssl http2;
143
+
server_name auth.example.com;
144
+
145
+
ssl_certificate /path/to/cert.pem;
146
+
ssl_certificate_key /path/to/key.pem;
147
+
148
+
# Security headers
149
+
add_header X-Frame-Options "DENY" always;
150
+
add_header X-Content-Type-Options "nosniff" always;
151
+
add_header X-XSS-Protection "1; mode=block" always;
152
+
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
153
+
add_header Permissions-Policy "geolocation=(), microphone=(), camera=()" always;
154
+
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
155
+
156
+
# Content Security Policy
157
+
add_header Content-Security-Policy "default-src 'self'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https:; script-src 'self'; connect-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self';" always;
158
+
159
+
location / {
160
+
proxy_pass http://localhost:3000;
161
+
proxy_set_header Host $host;
162
+
proxy_set_header X-Real-IP $remote_addr;
163
+
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
164
+
proxy_set_header X-Forwarded-Proto $scheme;
165
+
}
166
+
}
167
+
```
168
+
169
+
#### Caddy Example
170
+
171
+
```caddy
172
+
auth.example.com {
173
+
reverse_proxy localhost:3000
174
+
175
+
header {
176
+
X-Frame-Options "DENY"
177
+
X-Content-Type-Options "nosniff"
178
+
X-XSS-Protection "1; mode=block"
179
+
Referrer-Policy "strict-origin-when-cross-origin"
180
+
Permissions-Policy "geolocation=(), microphone=(), camera=()"
181
+
Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
182
+
Content-Security-Policy "default-src 'self'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https:; script-src 'self'; connect-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self';"
183
+
}
184
+
}
185
+
```
186
+
187
+
### Security Headers Explained
188
+
189
+
- **X-Frame-Options**: Prevents clickjacking attacks
190
+
- **X-Content-Type-Options**: Prevents MIME-sniffing
191
+
- **X-XSS-Protection**: Enables browser XSS filter
192
+
- **Referrer-Policy**: Controls referrer information
193
+
- **Permissions-Policy**: Restricts browser features
194
+
- **Strict-Transport-Security**: Enforces HTTPS
195
+
- **Content-Security-Policy**: Prevents XSS and data injection attacks
196
+
197
+
> [!NOTE]
198
+
> The CSP allows Google Fonts and user-provided profile images (`img-src https:`). Adjust based on your security requirements.
199
+
132
200
## Development
133
201
134
202
```bash