From 74daa0e7a1cbfafd9aeb255eaf064dfe47cd401c Mon Sep 17 00:00:00 2001 From: Erik Michelson Date: Tue, 3 Feb 2026 21:13:40 +0100 Subject: [PATCH] fix(security): headers were not applied to uploads Due to express static overriding the response, applying the extra headers like CSP and Content-Disposition did not work for files served under the /uploads route. By reordering, the code this works now. Signed-off-by: Erik Michelson --- app.js | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/app.js b/app.js index b935306d..34a4e1a7 100644 --- a/app.js +++ b/app.js @@ -156,6 +156,13 @@ app.use(cookieParser()) app.use(i18n.init) // routes without sessions +// security headers for uploads +app.use('/uploads', (req, res, next) => { + res.set('Content-Disposition', 'attachment') + res.set('Content-Security-Policy', "default-src 'none'") + next() +}) + // static files app.use('/', express.static(path.join(__dirname, '/public'), { maxAge: config.staticCacheTime, @@ -166,13 +173,6 @@ app.use('/docs', express.static(path.resolve(__dirname, config.docsPath), { maxAge: config.staticCacheTime, redirect: false })) -// This is done by an additional middleware, instead of setHeaders of express.static, because for what ever reason -// the latter did not work -app.use('/uploads', (req, res, next) => { - res.set('Content-Disposition', 'attachment') - res.set('Content-Security-Policy', "default-src 'none'") - next() -}) app.use('/uploads', express.static(path.resolve(__dirname, config.uploadsPath), { maxAge: config.staticCacheTime, redirect: false