From f3a1385aee241dcbf6a513d5926eae4cd7872e88 Mon Sep 17 00:00:00 2001 From: BlackDex Date: Mon, 9 Oct 2023 19:17:11 +0200 Subject: [PATCH] Do not send extra headers for Upgrade connection During a WebSocket connection we currently also send several headers which could cause issues with some reverse proxy, or with the CloudFlare tunnel for example. This PR resolves these issues. Fixes #3881 --- src/util.rs | 28 ++++++++++++++++++++++------ 1 file changed, 22 insertions(+), 6 deletions(-) diff --git a/src/util.rs b/src/util.rs index 52f371e4..2aef77b3 100644 --- a/src/util.rs +++ b/src/util.rs @@ -33,24 +33,41 @@ impl Fairing for AppHeaders { } async fn on_response<'r>(&self, req: &'r Request<'_>, res: &mut Response<'r>) { + let req_uri_path = req.uri().path(); + let req_headers = req.headers(); + + // Check if this connection is an Upgrade/WebSocket connection and return early + // We do not want add any extra headers, this could cause issues with reverse proxies or CloudFlare + if req_uri_path.ends_with("notifications/hub") || req_uri_path.ends_with("notifications/anonymous-hub") { + match (req_headers.get_one("connection"), req_headers.get_one("upgrade")) { + (Some(c), Some(u)) + if c.to_lowercase().contains("upgrade") && u.to_lowercase().contains("websocket") => + { + // Remove headers which could cause websocket connection issues + res.remove_header("X-Frame-Options"); + res.remove_header("X-Content-Type-Options"); + return; + } + (_, _) => (), + } + } + res.set_raw_header("Permissions-Policy", "accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), payment=(), picture-in-picture=(), screen-wake-lock=(), sync-xhr=(), usb=(), web-share=(), xr-spatial-tracking=()"); res.set_raw_header("Referrer-Policy", "same-origin"); res.set_raw_header("X-Content-Type-Options", "nosniff"); // Obsolete in modern browsers, unsafe (XS-Leak), and largely replaced by CSP res.set_raw_header("X-XSS-Protection", "0"); - let req_uri_path = req.uri().path(); - // Do not send the Content-Security-Policy (CSP) Header and X-Frame-Options for the *-connector.html files. // This can cause issues when some MFA requests needs to open a popup or page within the clients like WebAuthn, or Duo. - // This is the same behaviour as upstream Bitwarden. + // This is the same behavior as upstream Bitwarden. if !req_uri_path.ends_with("connector.html") { // # Frame Ancestors: // Chrome Web Store: https://chrome.google.com/webstore/detail/bitwarden-free-password-m/nngceckbapebfimnlniiiahkandclblb // Edge Add-ons: https://microsoftedge.microsoft.com/addons/detail/bitwarden-free-password/jbkfoedolllekgbhcbcoahefnbanhhlh?hl=en-US // Firefox Browser Add-ons: https://addons.mozilla.org/en-US/firefox/addon/bitwarden-password-manager/ // # img/child/frame src: - // Have I Been Pwned and Gravator to allow those calls to work. + // Have I Been Pwned to allow those calls to work. // # Connect src: // Leaked Passwords check: api.pwnedpasswords.com // 2FA/MFA Site check: api.2fa.directory @@ -72,7 +89,6 @@ impl Fairing for AppHeaders { {allowed_iframe_ancestors}; \ img-src 'self' data: \ https://haveibeenpwned.com \ - https://www.gravatar.com \ {icon_service_csp}; \ connect-src 'self' \ https://api.pwnedpasswords.com \ @@ -619,7 +635,7 @@ fn upcase_value(value: Value) -> Value { } } -// Inner function to handle some speciale case for the 'ssn' key. +// Inner function to handle a special case for the 'ssn' key. // This key is part of the Identity Cipher (Social Security Number) fn _process_key(key: &str) -> String { match key.to_lowercase().as_ref() {