karldns.de/karldns/web/security_headers.py

from __future__ import annotations

import logging
import time

from fastapi import FastAPI, Request
from fastapi.responses import PlainTextResponse
from starlette.concurrency import run_in_threadpool
from starlette.types import ASGIApp, Message, Receive, Scope, Send

from ..security import client_ip, is_rate_limited_path, rate_limit_bucket
from ..settings import DdnsSettings
from ..store import DdnsStore

ACCESS_LOGGER = logging.getLogger("karldns.access")


class RequestBodyTooLargeError(Exception):
    pass


class RequestBodyLimitMiddleware:
    def __init__(self, app: ASGIApp, max_body_bytes: int) -> None:
        self.app = app
        self.max_body_bytes = max_body_bytes

    async def __call__(self, scope: Scope, receive: Receive, send: Send) -> None:
        if scope["type"] != "http":
            await self.app(scope, receive, send)
            return

        received = 0

        async def limited_receive() -> Message:
            nonlocal received
            message = await receive()
            if message["type"] == "http.request":
                received += len(message.get("body", b""))
                if received > self.max_body_bytes:
                    raise RequestBodyTooLargeError
            return message

        try:
            await self.app(scope, limited_receive, send)
        except RequestBodyTooLargeError:
            response = PlainTextResponse("request body too large", status_code=413)
            await response(scope, receive, send)



def install_security_middleware(app: FastAPI, settings: DdnsSettings, store: DdnsStore) -> None:
    @app.middleware("http")
    async def security_middleware(request: Request, call_next):
        started_at = time.perf_counter()
        try:
            content_length = int(request.headers.get("content-length", "0") or "0")
        except ValueError:
            content_length = 0
        if content_length > settings.max_request_body_bytes:
            return PlainTextResponse("request body too large", status_code=413)

        if is_rate_limited_path(request.url.path) or is_admin_path(request.url.path, settings):
            limit = (
                settings.admin_rate_limit_per_minute
                if is_admin_path(request.url.path, settings)
                else settings.rate_limit_per_minute
            )
            key = f"{client_ip(request, settings)}:{rate_limit_bucket(request.url.path)}"
            allowed = await run_in_threadpool(store.allow_rate_limit, key, limit)
            if not allowed:
                await run_in_threadpool(store.increment_metric, "rate_limit_hits_total")
                return PlainTextResponse("rate limit exceeded", status_code=429)

        response = await call_next(request)
        if is_secret_response(request):
            response.headers["Cache-Control"] = "no-store"
            response.headers["Pragma"] = "no-cache"
        if is_noindex_response(request):
            response.headers["X-Robots-Tag"] = "noindex, nofollow"
        response.headers["X-Content-Type-Options"] = "nosniff"
        response.headers["X-Frame-Options"] = "DENY"
        response.headers["Referrer-Policy"] = "same-origin"
        response.headers["Permissions-Policy"] = "geolocation=(), microphone=(), camera=()"
        response.headers["Content-Security-Policy"] = content_security_policy(request.url.path)
        if settings.public_base_url.startswith("https://"):
            response.headers["Strict-Transport-Security"] = "max-age=31536000; includeSubDomains"
        if settings.redacted_access_log:
            elapsed_ms = (time.perf_counter() - started_at) * 1000
            ACCESS_LOGGER.info(
                "%s %s status=%s duration_ms=%.2f",
                request.method,
                redacted_access_path(request.url.path),
                response.status_code,
                elapsed_ms,
            )
        return response


def is_admin_path(path: str, settings: DdnsSettings) -> bool:
    admin_path = settings.admin_path.rstrip("/")
    return path == admin_path or path.startswith(f"{admin_path}/") or path.startswith("/api/v1/admin/")


def is_secret_response(request: Request) -> bool:
    path = request.url.path
    settings = request.app.state.settings
    if is_admin_path(path, settings) or path.startswith("/m/"):
        return True
    if path.startswith(("/api/v1/hostnames", "/api/v1/router/")):
        return True
    if path.startswith("/api/v1/admin/"):
        return True
    return request.method == "POST" and path == "/"


def is_noindex_response(request: Request) -> bool:
    path = request.url.path
    if request.method != "GET":
        return True
    if path in {"/openapi.json", "/healthz"}:
        return True
    if path.startswith(("/api/", "/m/")):
        return True
    return is_admin_path(path, request.app.state.settings)


def content_security_policy(path: str) -> str:
    script_src = "script-src 'self' 'unsafe-inline'; " if path in {"/", "/privacy"} else "script-src 'self'; "
    return (
        "default-src 'self'; "
        f"{script_src}"
        "style-src 'self'; "
        "img-src 'self' data:; "
        "font-src 'self'; "
        "connect-src 'self'; "
        "form-action 'self'; "
        "frame-ancestors 'none'"
    )


def redacted_access_path(path: str) -> str:
    secret_prefixes = {
        "/m": "/m/<secret>",
        "/api/v1/hostnames": "/api/v1/hostnames/<secret>",
        "/api/v1/router/register": "/api/v1/router/register/<secret>",
        "/api/v1/router/update": "/api/v1/router/update/<secret>",
    }
    for prefix, replacement in secret_prefixes.items():
        if path == prefix or path.startswith(f"{prefix}/"):
            return replacement
    return path