empayre/fleet
14
0
Fork 0
mirror of https://github.com/empayre/fleet.git synced 2024-11-06 17:05:18 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
4042f8d826
fleet/server/service
History
Roberto Dip 4042f8d826
add browser-related security headers to HTML responses (#8180) 
related to #8031, this adds the following headers to HTML responses:

- Strict-Transport-Security: informs browsers that the site should only
  be accessed using HTTPS, and that any future attempts to access it
  using HTTP should automatically be converted to HTTPS.
- X-Frames-Options: disallows embedding the UI in other sites via
  <frame>, <iframe>, <embed> or <object>, which can prevent attacks like
  clickjacking.
- X-Content-Type-Options: prevents browsers from trying to guess the MIME
  type which can cause browsers to transform non-executable content into
  executable content.
- Referrer-Policy: prevents leaking the origin of the referrer in the
  Referer.

additionally, this ensures we set `X-Content-Type-Options` for CSV and
installer responses.
2022-10-12 10:19:21 -03:00
..
async Support async saving of scheduled query statistics (#7012) 2022-08-10 10:01:05 -04:00
externalsvc Support failing policies integrations (#5973) 2022-06-06 10:41:51 -04:00
middleware Set authz checked when rate limiting device endpoints (#6702) 2022-07-18 14:22:49 -03:00
mock Add distributed discovery query support for detail queries, add orbit… (#4597) 2022-03-15 16:51:00 -03:00
osquery_utils Add missing return to ingestKubequeryInfo (#8178) 2022-10-12 09:00:49 -03:00
redis_policy_set Migrate team-related endpoints to new pattern (#3740) 2022-01-19 10:52:14 -05:00
schedule Refactor webhooks cron to new schedule package (#7840) 2022-09-20 14:26:36 -05:00
testdata add endpoint to serve the kolide certificate back to the user (#1025) 2017-01-20 14:32:10 -05:00
activities_test.go Merge pull request from GHSA-pr2g-j78h-84cr 2022-04-18 10:27:30 -07:00
activities.go Refactor ListActivities to new endpoint pattern (#3115) 2021-11-29 08:12:22 -05:00
appconfig_test.go Validate team and appconfig payloads, with dry-run and force modes (#7731) 2022-09-19 13:53:44 -04:00
appconfig.go Keep created_at timestamp of existing enroll secrets (#8062) 2022-10-05 08:35:36 -04:00
apple_mdm_test.go Add Apple MDM functionality (#7940) 2022-10-05 19:53:54 -03:00
apple_mdm.go Add Apple MDM functionality (#7940) 2022-10-05 19:53:54 -03:00
base_client_errors.go add Go client to consume device endpoints (#5987) 2022-06-01 20:05:05 -03:00
base_client_test.go make orbit and device ping paths unversioned (#7933) 2022-09-26 14:39:56 -03:00
base_client.go add backwards compatiblity to orbit enrollment via the API (#7921) 2022-09-26 11:44:09 -03:00
campaigns_test.go fleetctl query improve error message (#5141) 2022-04-20 11:35:46 -06:00
campaigns.go Validate team and appconfig payloads, with dry-run and force modes (#7731) 2022-09-19 13:53:44 -04:00
carves_test.go Add missing error checking to test config setup (#4401) 2022-03-11 12:51:12 -03:00
carves.go Add new endpoints to retrieve device information by orbit identifier (#4531) 2022-03-09 16:13:56 -05:00
client_appconfig.go Validate team and appconfig payloads, with dry-run and force modes (#7731) 2022-09-19 13:53:44 -04:00
client_apple_mdm.go Add Apple MDM functionality (#7940) 2022-10-05 19:53:54 -03:00
client_carves.go Introduce API version 2022-04, deprecate use of /global in paths (#4731) 2022-04-05 11:35:53 -04:00
client_debug.go don't clear errors automatically when reading them from Redis (#5623) 2022-05-10 11:44:43 -03:00
client_hosts.go add upgrade tests (#6596) 2022-07-19 15:11:51 -06:00
client_labels.go Introduce API version 2022-04, deprecate use of /global in paths (#4731) 2022-04-05 11:35:53 -04:00
client_live_query_test.go add Go client to consume device endpoints (#5987) 2022-06-01 20:05:05 -03:00
client_live_query.go Unversion the /setup endpoint, version the websocket endpoint (#5104) 2022-04-20 15:57:26 -04:00
client_packs.go Introduce API version 2022-04, deprecate use of /global in paths (#4731) 2022-04-05 11:35:53 -04:00
client_policies.go Introduce API version 2022-04, deprecate use of /global in paths (#4731) 2022-04-05 11:35:53 -04:00
client_queries.go Introduce API version 2022-04, deprecate use of /global in paths (#4731) 2022-04-05 11:35:53 -04:00
client_sessions.go Introduce API version 2022-04, deprecate use of /global in paths (#4731) 2022-04-05 11:35:53 -04:00
client_setup.go fleetctl preview to use v1 setup path, to support previous versions of fleet (#5331) 2022-04-25 10:02:21 -03:00
client_software.go add upgrade tests (#6596) 2022-07-19 15:11:51 -06:00
client_targets.go Introduce API version 2022-04, deprecate use of /global in paths (#4731) 2022-04-05 11:35:53 -04:00
client_teams.go Validate team and appconfig payloads, with dry-run and force modes (#7731) 2022-09-19 13:53:44 -04:00
client_users.go Introduce API version 2022-04, deprecate use of /global in paths (#4731) 2022-04-05 11:35:53 -04:00
client.go Add Apple MDM functionality (#7940) 2022-10-05 19:53:54 -03:00
debug_handler_test.go Add fleetctl debug migrations command to get missing migrations (#2967) 2021-11-22 14:06:12 -03:00
debug_handler.go Issue 3173 debug status processlist (#4009) 2022-02-03 14:56:22 -03:00
device_client_test.go token rotation for fleet desktop (#7779) 2022-10-10 17:15:35 -03:00
device_client.go token rotation for fleet desktop (#7779) 2022-10-10 17:15:35 -03:00
devices.go token rotation for fleet desktop (#7779) 2022-10-10 17:15:35 -03:00
endpoint_campaigns.go Unversion the /setup endpoint, version the websocket endpoint (#5104) 2022-04-20 15:57:26 -04:00
endpoint_middleware_test.go Add missing error checking to test config setup (#4401) 2022-03-11 12:51:12 -03:00
endpoint_middleware.go Orbit remote management for flags (#7246) 2022-09-24 00:30:23 +05:30
endpoint_setup.go Add read replica testing helpers and fix non-sso login bug (#4908) 2022-04-04 16:52:05 -07:00
endpoint_utils_test.go add browser-related security headers to HTML responses (#8180) 2022-10-12 10:19:21 -03:00
endpoint_utils.go add browser-related security headers to HTML responses (#8180) 2022-10-12 10:19:21 -03:00
frontend.go add browser-related security headers to HTML responses (#8180) 2022-10-12 10:19:21 -03:00
global_policies_test.go Add missing error checking to test config setup (#4401) 2022-03-11 12:51:12 -03:00
global_policies.go Validate team and appconfig payloads, with dry-run and force modes (#7731) 2022-09-19 13:53:44 -04:00
global_schedule_test.go Add validation for pack scheduled query interval (#5918) 2022-05-26 16:54:21 -05:00
global_schedule.go Merge pull request from GHSA-pr2g-j78h-84cr 2022-04-18 10:27:30 -07:00
handler_test.go Introduce API version 2022-04, deprecate use of /global in paths (#4731) 2022-04-05 11:35:53 -04:00
handler.go token rotation for fleet desktop (#7779) 2022-10-10 17:15:35 -03:00
hosts_test.go Add low_disk_space_count property to GET /host_summary (#7872) 2022-09-21 15:56:17 -04:00
hosts.go add browser-related security headers to HTML responses (#8180) 2022-10-12 10:19:21 -03:00
http_auth_test.go Introduce API version 2022-04, deprecate use of /global in paths (#4731) 2022-04-05 11:35:53 -04:00
http_auth.go Remove unused request-id in context (#3632) 2022-01-13 14:12:56 -08:00
http_publicip.go Add public ip to hosts & derive geolocation when rendering host (#4652) 2022-03-21 12:29:52 -04:00
installer_test.go adjust installers endpoint to avoid AJAX downloads (#7226) 2022-08-16 12:54:41 -03:00
installer.go add browser-related security headers to HTML responses (#8180) 2022-10-12 10:19:21 -03:00
integration_core_test.go add browser-related security headers to HTML responses (#8180) 2022-10-12 10:19:21 -03:00
integration_desktop_test.go add headers denoting capabilities between fleet server / desktop / orbit (#7833) 2022-09-26 07:53:53 -03:00
integration_ds_only_test.go Support async saving of hosts' last seen time (#5640) 2022-05-10 11:29:17 -04:00
integration_enterprise_test.go Add inherited policies to the team's list policies response payload (#8068) 2022-10-12 08:35:36 -04:00
integration_live_queries_test.go enable controlled rollout of features by teams (#7408) 2022-08-30 08:13:09 -03:00
integration_logger_test.go Fix integration logger test (#8014) 2022-09-28 16:35:54 -04:00
integration_sandbox_test.go add browser-related security headers to HTML responses (#8180) 2022-10-12 10:19:21 -03:00
integration_sso_test.go Validate team and appconfig payloads, with dry-run and force modes (#7731) 2022-09-19 13:53:44 -04:00
invites_test.go Fix update invite email conflict (#4751) 2022-03-28 09:38:57 -06:00
invites.go Fix update invite email conflict (#4751) 2022-03-28 09:38:57 -06:00
jitter_test.go Migrate special-case endpoints to new pattern (#4511) 2022-03-08 11:27:38 -05:00
jitter.go Migrate special-case endpoints to new pattern (#4511) 2022-03-08 11:27:38 -05:00
labels_test.go Do not use golangci action for better reproducibility (use make lint-go) (#6175) 2022-06-10 18:52:24 -03:00
labels.go Improve live query UX (#5749) 2022-06-10 13:29:45 -05:00
live_queries.go Shorten "simple" query API period to 25s (#3775) 2022-01-19 17:48:57 -08:00
mem_failing_policies_set_test.go Fix failing policy sets for redis cluster mode (#3725) 2022-01-17 15:16:54 -05:00
metrics_appconfig.go Validate team and appconfig payloads, with dry-run and force modes (#7731) 2022-09-19 13:53:44 -04:00
metrics_change_email.go Update go-kit to 0.4.0 (#1411) 2017-03-15 08:55:30 -07:00
metrics_invites.go Add v4 suffix in go.mod (#1224) 2021-06-25 21:46:51 -07:00
metrics_labels.go Add v4 suffix in go.mod (#1224) 2021-06-25 21:46:51 -07:00
metrics_sessions.go add back-end implementation for SSO JIT provisioning (#7182) 2022-08-15 14:42:33 -03:00
metrics_users.go Add v4 suffix in go.mod (#1224) 2021-06-25 21:46:51 -07:00
metrics.go Issue 1362 fleetctl user roles (#1397) 2021-07-16 15:28:13 -03:00
orbit_client.go token rotation for fleet desktop (#7779) 2022-10-10 17:15:35 -03:00
orbit.go token rotation for fleet desktop (#7779) 2022-10-10 17:15:35 -03:00
osquery_test.go token rotation for fleet desktop (#7779) 2022-10-10 17:15:35 -03:00
osquery.go token rotation for fleet desktop (#7779) 2022-10-10 17:15:35 -03:00
packs_test.go Add missing error checking to test config setup (#4401) 2022-03-11 12:51:12 -03:00
packs.go Validate team and appconfig payloads, with dry-run and force modes (#7731) 2022-09-19 13:53:44 -04:00
queries_test.go Add missing error checking to test config setup (#4401) 2022-03-11 12:51:12 -03:00
queries.go Validate team and appconfig payloads, with dry-run and force modes (#7731) 2022-09-19 13:53:44 -04:00
scheduled_queries_test.go Add validation for pack scheduled query interval (#5918) 2022-05-26 16:54:21 -05:00
scheduled_queries.go Validate team and appconfig payloads, with dry-run and force modes (#7731) 2022-09-19 13:53:44 -04:00
service_appconfig_test.go Validate team and appconfig payloads, with dry-run and force modes (#7731) 2022-09-19 13:53:44 -04:00
service_appconfig.go improve vuln cpe matching on macos (#6985) 2022-09-01 10:02:07 -06:00
service_campaign_test.go Allow troubleshooting of mocked live query store (#6197) 2022-06-13 10:18:03 -03:00
service_campaigns.go Add read replica testing helpers and fix non-sso login bug (#4908) 2022-04-04 16:52:05 -07:00
service_errors.go Improve developer documentation: Update seed data documentation (#7904) 2022-10-05 12:42:45 -04:00
service_users.go add back-end implementation for SSO JIT provisioning (#7182) 2022-08-15 14:42:33 -03:00
service.go Add Apple MDM functionality (#7940) 2022-10-05 19:53:54 -03:00
sessions_test.go Add logging to capture user email upon successful login (#7927) 2022-09-27 16:32:46 -03:00
sessions.go Log user email upon successful SSO login (#8012) 2022-09-29 09:25:45 -05:00
software_test.go Merge pull request from GHSA-pr2g-j78h-84cr 2022-04-18 10:27:30 -07:00
software.go Include CVE scores when listing software (#5673) 2022-05-20 10:58:40 -06:00
status.go Migrate the last batch of authenticatedUser endpoints to the new pattern (#4210) 2022-02-15 15:22:19 -05:00
targets_test.go Improve live query UX (#5749) 2022-06-10 13:29:45 -05:00
targets.go Improve live query UX (#5749) 2022-06-10 13:29:45 -05:00
team_policies_test.go Add inherited policies to the team's list policies response payload (#8068) 2022-10-12 08:35:36 -04:00
team_policies.go Add inherited policies to the team's list policies response payload (#8068) 2022-10-12 08:35:36 -04:00
team_schedule_test.go Add validation for pack scheduled query interval (#5918) 2022-05-26 16:54:21 -05:00
team_schedule.go Merge pull request from GHSA-pr2g-j78h-84cr 2022-04-18 10:27:30 -07:00
teams_test.go Validate team and appconfig payloads, with dry-run and force modes (#7731) 2022-09-19 13:53:44 -04:00
teams.go Validate team and appconfig payloads, with dry-run and force modes (#7731) 2022-09-19 13:53:44 -04:00
testing_client.go Add new low_disk_space URL parameter to the GET /hosts endpoint (and GET /hosts/count) (#7853) 2022-09-21 15:16:31 -04:00
testing_utils.go Handle tcp read timeouts (#8163) 2022-10-11 13:58:52 -03:00
translator.go Migrate special-case endpoints to new pattern (#4511) 2022-03-08 11:27:38 -05:00
transport_error_test.go Create errors with ctxerr, add the call to store them in redis (#2786) 2021-11-15 09:11:38 -05:00
transport_error.go Handle tcp read timeouts (#8163) 2022-10-11 13:58:52 -03:00
transport_setup.go Update go-kit to 0.4.0 (#1411) 2017-03-15 08:55:30 -07:00
transport_test.go Add v4 suffix in go.mod (#1224) 2021-06-25 21:46:51 -07:00
transport.go add browser-related security headers to HTML responses (#8180) 2022-10-12 10:19:21 -03:00
user_roles.go Migrate special-case endpoints to new pattern (#4511) 2022-03-08 11:27:38 -05:00
users_test.go Sentence case error (#6845) 2022-07-25 13:14:05 -04:00
users.go add back-end implementation for SSO JIT provisioning (#7182) 2022-08-15 14:42:33 -03:00
validation_setup.go Use new error handling approach in other packages (#2954) 2021-11-22 09:13:26 -05:00