From 09ebf60b78ae889a98824e0e35ca67ed53c5af27 Mon Sep 17 00:00:00 2001
From: Jake Jarvis <jakejarvis@gmail.com>
Date: Sun, 10 Mar 2019 09:46:59 -0400
Subject: [PATCH] secure cookies for matomo

---
 layouts/partials/footer.html |  1 +
 worker.js                    | 52 ++++++++++++++++++++++++++++++++++++
 2 files changed, 53 insertions(+)
 create mode 100644 worker.js

diff --git a/layouts/partials/footer.html b/layouts/partials/footer.html
index dbda3269..72f3b9c3 100644
--- a/layouts/partials/footer.html
+++ b/layouts/partials/footer.html
@@ -1,6 +1,7 @@
     <script>
       var _paq = _paq || [];
       _paq.push(['setRequestMethod', 'POST']);
+      _paq.push(['setSecureCookie', true]);
       _paq.push(['trackPageView']);
       _paq.push(['enableLinkTracking']);
       _paq.push(['enableHeartBeatTimer']);
diff --git a/worker.js b/worker.js
new file mode 100644
index 00000000..05a60d51
--- /dev/null
+++ b/worker.js
@@ -0,0 +1,52 @@
+let securityHeaders = {
+	"Content-Security-Policy": "default-src 'none'; script-src 'self' stats.jarv.is 'sha256-QwZM+dNl2R1KcXo8ORmpT3mqAVwIBbEcJBmWYurBNv4='; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self'; object-src 'self'; media-src 'self'; base-uri 'none'; form-action 'self'; frame-src 'self'; frame-ancestors 'self'; worker-src 'none'; connect-src 'self' jarvis.report-uri.com stats.jarv.is; upgrade-insecure-requests; report-uri https://jarvis.report-uri.com/r/d/csp/enforce; report-to default",
+	"Report-To": "{\"group\":\"default\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://jarvis.report-uri.com/a/d/g\"}]}",
+	"NEL": "{\"report_to\":\"default\",\"max_age\":604800}",
+//	"Strict-Transport-Security" : "max-age=1000",
+	"X-Xss-Protection": "1; mode=block; report=https://jarvis.report-uri.com/r/d/xss/enforce",
+	"X-Frame-Options": "SAMEORIGIN",
+	"X-Content-Type-Options": "nosniff",
+	"Referrer-Policy": "same-origin",
+	"X-DNS-Prefetch-Control": "off",
+	"X-UA-Compatible": "IE=edge",
+	"X-Permitted-Cross-Domain-Policies": "none",
+	"Feature-Policy": "accelerometer 'none'; camera 'none'; geolocation 'none'; gyroscope 'none'; magnetometer 'none'; microphone 'none'; sync-xhr 'none'; payment 'none'; usb 'none'; vr 'none'"
+}
+
+let removeHeaders = [
+	"Last-Modified",
+	"Expires",
+	"Public-Key-Pins",
+	"X-Powered-By",
+	"x-amz-request-id",
+	"x-amz-id-2",
+	"x-amz-bucket",
+	"x-amz-bucket-region",
+	"x-amz-error-code",
+	"x-amz-error-message",
+	"x-amz-error-detail-key",
+	"x-amz-version-id"
+]
+
+addEventListener('fetch', event => {
+	event.respondWith(addHeaders(event.request))
+})
+
+async function addHeaders(req) {
+	let response = await fetch(req)
+	let newHeaders = new Headers(response.headers)
+
+	Object.keys(securityHeaders).map(function(name, index) {
+		newHeaders.set(name, securityHeaders[name]);
+  })
+
+	removeHeaders.forEach(function(name){
+		newHeaders.delete(name)
+	})
+
+	return new Response(response.body , {
+		status: response.status,
+		statusText: response.statusText,
+		headers: newHeaders
+	})
+}
\ No newline at end of file