Show HN: Self-hosted and self-contained web app password manager written in Go

Re:Show HN: Self-hosted and self-contained web app password ... by juliend2 on Friday January 03, 2020 @02:08PM (#21949202)

Congrats for doing this!

Regarding this:

> There should be no problems with running on a publicly-accessible server [...]

Looking at the https://github.com/jarmo/secrets-web source code, I don't see any place where it sets the `Content-Security-Policy` header. Or am I missing something?

[ Parent | on HN ]

Re:Show HN: Self-hosted and self-contained web app password ... by jarm0 on Saturday January 04, 2020 @06:46AM (#21954371)

All security headers were supposed to be added by gin-contrib/secure middleware (https://github.com/gin-contrib/secure). However, your comment made me verify that it actually works as it was doing at the time of starting to use that. I noticed that headers were not present - it seems that somehow the order of registering middlewares had made it not work. I've released a new version where they all work https://github.com/jarmo/secrets-web/releases/tag/v1.0.1

Thanks for making me look into it and finding out about this problem.

[ Parent | on HN ]