cda9a7a8ff
H1 — trusted_proxies RFC-1918 dans framework.yaml : rate limiting
opérationnel derrière Traefik (IP client réelle, pas IP Traefik)
H2 — En-têtes HTTP dans Caddyfile : X-Frame-Options DENY,
X-Content-Type-Options nosniff, Referrer-Policy, Permissions-Policy,
suppression header Server
H3 — API Platform docs désactivés en when@prod (Swagger UI, ReDoc)
M1 — Rate limiter sur DELETE /api/push/subscribe (manquant)
M2 — Validation FILTER_VALIDATE_URL sur endpoint push avant stockage
M3 — APP_ENV=prod dans backend/.env (était dev — risque si .env.local absent)
M4 — Limite 4096 octets sur le body JSON (FeedbackController + PushController)
M5 — Service Worker : open redirect corrigé (targetUrl validé contre l'origine)
B1 — robots.txt créé (bloque /api/ et /bundles/)
B3 — --time-limit=3600 sur les workers Messenger (rotation + libération mémoire)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
47 lines
1.3 KiB
JavaScript
47 lines
1.3 KiB
JavaScript
// Service Worker — Sargasse-Sentry push notifications
|
|
self.addEventListener('push', (event) => {
|
|
if (!event.data) return;
|
|
|
|
let payload;
|
|
try {
|
|
payload = event.data.json();
|
|
} catch {
|
|
payload = { title: 'Alerte sargasses', body: event.data.text() };
|
|
}
|
|
|
|
const title = payload.title ?? 'Alerte sargasses';
|
|
const options = {
|
|
body: payload.body ?? '',
|
|
icon: '/icons.svg',
|
|
badge: '/icons.svg',
|
|
tag: payload.spotId ? `sargasse-${payload.spotId}` : 'sargasse-alert',
|
|
renotify: true,
|
|
data: { url: payload.url ?? '/' },
|
|
};
|
|
|
|
event.waitUntil(self.registration.showNotification(title, options));
|
|
});
|
|
|
|
self.addEventListener('notificationclick', (event) => {
|
|
event.notification.close();
|
|
|
|
const rawUrl = event.notification.data?.url ?? '/';
|
|
// N'autoriser que les URLs relatives ou du même domaine (protection open redirect)
|
|
const targetUrl = (rawUrl.startsWith('/') || rawUrl.startsWith(self.location.origin))
|
|
? rawUrl
|
|
: '/';
|
|
|
|
event.waitUntil(
|
|
clients.matchAll({ type: 'window', includeUncontrolled: true }).then((windowClients) => {
|
|
for (const client of windowClients) {
|
|
if (client.url === targetUrl && 'focus' in client) {
|
|
return client.focus();
|
|
}
|
|
}
|
|
if (clients.openWindow) {
|
|
return clients.openWindow(targetUrl);
|
|
}
|
|
})
|
|
);
|
|
});
|