Method ToMiddleware

middleware/secure.go:101–155

ToMiddleware converts SecureConfig to middleware or returns an error for invalid configuration

()

// ToMiddleware converts SecureConfig to middleware or returns an error for invalid configuration
func (config SecureConfig) ToMiddleware() (echo.MiddlewareFunc, error) {
	// Defaults
	if config.Skipper == nil {
		config.Skipper = DefaultSecureConfig.Skipper
	}

	// Precompute the Strict-Transport-Security header value once: it depends only on immutable config,
	// so there is no need to rebuild it with fmt.Sprintf on every HTTPS request. Empty when HSTS is disabled.
	hstsValue := ""
	if config.HSTSMaxAge != 0 {
		subdomains := ""
		if !config.HSTSExcludeSubdomains {
			subdomains = "; includeSubdomains"
		}
		if config.HSTSPreloadEnabled {
			subdomains += "; preload"
		}
		hstsValue = fmt.Sprintf("max-age=%d%s", config.HSTSMaxAge, subdomains)
	}

	return func(next echo.HandlerFunc) echo.HandlerFunc {
		return func(c *echo.Context) error {
			if config.Skipper(c) {
				return next(c)
			}

			req := c.Request()
			res := c.Response()

			if config.XSSProtection != "" {
				res.Header().Set(echo.HeaderXXSSProtection, config.XSSProtection)
			}
			if config.ContentTypeNosniff != "" {
				res.Header().Set(echo.HeaderXContentTypeOptions, config.ContentTypeNosniff)
			}
			if config.XFrameOptions != "" {
				res.Header().Set(echo.HeaderXFrameOptions, config.XFrameOptions)
			}
			if hstsValue != "" && (c.IsTLS() || (req.Header.Get(echo.HeaderXForwardedProto) == "https")) {
				res.Header().Set(echo.HeaderStrictTransportSecurity, hstsValue)
			}
			if config.ContentSecurityPolicy != "" {
				if config.CSPReportOnly {
					res.Header().Set(echo.HeaderContentSecurityPolicyReportOnly, config.ContentSecurityPolicy)
				} else {
					res.Header().Set(echo.HeaderContentSecurityPolicy, config.ContentSecurityPolicy)
				}
			}
			if config.ReferrerPolicy != "" {
				res.Header().Set(echo.HeaderReferrerPolicy, config.ReferrerPolicy)
			}
			return next(c)
		}
	}, nil
}