Uwe Schuster
0d2312499e
Aligns the default CSP, X-Frame-Options, HSTS and Permissions-Policy with
docs/security-baseline.md:
- script-src/style-src drop 'unsafe-inline' and the unpkg.com allowance
- img-src narrows from 'self' data: https: → 'self' data:
- connect-src narrows from 'self' wss: ws: → 'self'
- frame-ancestors flips from 'self' → 'none'
- X-Frame-Options flips from SAMEORIGIN → DENY
- HSTS keeps max-age=63072000 but drops includeSubDomains by default
(apex-clobbering hazard noted in audit #1)
- Permissions-Policy header added with the baseline sensor allowlist
Adds a CspOverride struct + ctor so consumers that genuinely need a
relaxation (Swagger UI subtree, cross-origin connect, …) can flip
individual directives without forking the interceptor. Empty fields
inherit the strict baseline.
Bumps to 0.3.6 (alongside owner's pending #4 + #5 + #6 work).
Closes #3
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
55 lines
2.1 KiB
CMake
55 lines
2.1 KiB
CMake
cmake_minimum_required(VERSION 3.14)
|
|
project(oatpp-authkit VERSION 0.3.6 LANGUAGES CXX)
|
|
|
|
# Header-only interface library — no compilation, just an include path and
|
|
# a CMake config package so consumers do:
|
|
# find_package(oatpp-authkit REQUIRED)
|
|
# target_link_libraries(app PRIVATE oatpp::authkit)
|
|
#
|
|
# Or FetchContent:
|
|
# FetchContent_Declare(oatpp-authkit GIT_REPOSITORY ... GIT_TAG v0.1.0)
|
|
# FetchContent_MakeAvailable(oatpp-authkit)
|
|
|
|
add_library(oatpp-authkit INTERFACE)
|
|
add_library(oatpp::authkit ALIAS oatpp-authkit)
|
|
|
|
target_include_directories(oatpp-authkit INTERFACE
|
|
$<BUILD_INTERFACE:${CMAKE_CURRENT_SOURCE_DIR}/include>
|
|
$<INSTALL_INTERFACE:include>
|
|
)
|
|
target_compile_features(oatpp-authkit INTERFACE cxx_std_17)
|
|
|
|
# Installation
|
|
include(GNUInstallDirs)
|
|
include(CMakePackageConfigHelpers)
|
|
|
|
install(DIRECTORY include/ DESTINATION ${CMAKE_INSTALL_INCLUDEDIR})
|
|
install(TARGETS oatpp-authkit EXPORT oatpp-authkit-targets)
|
|
install(EXPORT oatpp-authkit-targets
|
|
FILE oatpp-authkit-targets.cmake
|
|
NAMESPACE oatpp::
|
|
DESTINATION ${CMAKE_INSTALL_LIBDIR}/cmake/oatpp-authkit)
|
|
|
|
write_basic_package_version_file(
|
|
"${CMAKE_CURRENT_BINARY_DIR}/oatpp-authkit-config-version.cmake"
|
|
VERSION ${PROJECT_VERSION}
|
|
COMPATIBILITY SameMajorVersion)
|
|
|
|
configure_package_config_file(
|
|
cmake/oatpp-authkit-config.cmake.in
|
|
"${CMAKE_CURRENT_BINARY_DIR}/oatpp-authkit-config.cmake"
|
|
INSTALL_DESTINATION ${CMAKE_INSTALL_LIBDIR}/cmake/oatpp-authkit)
|
|
|
|
install(FILES
|
|
"${CMAKE_CURRENT_BINARY_DIR}/oatpp-authkit-config.cmake"
|
|
"${CMAKE_CURRENT_BINARY_DIR}/oatpp-authkit-config-version.cmake"
|
|
DESTINATION ${CMAKE_INSTALL_LIBDIR}/cmake/oatpp-authkit)
|
|
|
|
# ─── Tests ───────────────────────────────────────────────────────────────────
|
|
# Off by default so consumers pulling us in via FetchContent don't pay the
|
|
# cost. Enable with -DOATPP_AUTHKIT_BUILD_TESTS=ON.
|
|
option(OATPP_AUTHKIT_BUILD_TESTS "Build oatpp-authkit unit tests" OFF)
|
|
if(OATPP_AUTHKIT_BUILD_TESTS)
|
|
enable_testing()
|
|
add_subdirectory(test)
|
|
endif()
|