zhttp – zgo.at/zhttp/header Index | Examples | Files

package header

import "zgo.at/zhttp/header"

Package header provides functions for parsing and setting HTTP headers.

Index

Examples

Constants 

const (
	// Fetch directives
	CSPChildSrc    = "child-src"    // Web workers and nested contexts such as frames
	CSPConnectSrc  = "connect-src"  // Script interfaces: Ajax, WebSocket, Fetch API, etc
	CSPDefaultSrc  = "default-src"  // Fallback for the other directives
	CSPFontSrc     = "font-src"     // Custom fonts
	CSPFrameSrc    = "frame-src"    // <frame> and <iframe>
	CSPImgSrc      = "img-src"      // Images (HTML and CSS), favicon
	CSPManifestSrc = "manifest-src" // Web app manifest
	CSPMediaSrc    = "media-src"    // <audio> and <video>
	CSPObjectSrc   = "object-src"   // <object>, <embed>, and <applet>
	CSPScriptSrc   = "script-src"   // JavaScript
	CSPStyleSrc    = "style-src"    // CSS

	// Document directives govern the properties of a document
	CSPBaseURI     = "base-uri"     // Restrict what can be used in <base>
	CSPPluginTypes = "plugin-types" // Whitelist MIME types for <object>, <embed>, <applet>
	CSPSandbox     = "sandbox"      // Enable sandbox for the page

	// Navigation directives govern whereto a user can navigate
	CSPFormAction     = "form-action"     // Restrict targets for form submissions
	CSPFrameAncestors = "frame-ancestors" // Valid parents for embedding with frames, <object>, etc.

	// Reporting directives control the reporting process of CSP violations; see
	// also the Content-Security-Policy-Report-Only header
	CSPReportURI = "report-uri"

	// Other directives
	CSPBlockAllMixedContent = "block-all-mixed-content" // Don't load any HTTP content when using https
)

CSP Directives. 

const (
	CSPSourceSelf         = "'self'"          // Exact origin of the document
	CSPSourceNone         = "'none'"          // Nothing matches
	CSPSourceUnsafeInline = "'unsafe-inline'" // Inline <script>/<style>, onevent="", etc.
	CSPSourceUnsafeEval   = "'unsafe-eval'"   // eval()
	CSPSourceStar         = "*"               // Everything

	CSPSourceHTTP        = "http:"
	CSPSourceHTTPS       = "https:"
	CSPSourceData        = "data:"
	CSPSourceMediastream = "mediastream:"
	CSPSourceBlob        = "blob:"
	CSPSourceFilesystem  = "filesystem:"
)

Content-Security-Policy values 

const (
	TypeInline     = "inline"
	TypeAttachment = "attachment"
)

Constants for DispositionArgs.

Functions

func Copy 

func Copy(header http.Header) http.Header

Copy returns a shallow copy of the header.

func ParseList 

func ParseList(header http.Header, key string) []string

ParseList parses a comma separated list of values. Commas are ignored in quoted strings. Quoted values are not unescaped or unquoted. Whitespace is trimmed.

func ParseTime 

func ParseTime(header http.Header, key string) time.Time

ParseTime parses the header as time. The zero value is returned if the header is not present or there is an error parsing the header.

func ParseValueAndParams 

func ParseValueAndParams(header http.Header, key string) (value string, params map[string]string)

ParseValueAndParams parses a comma separated list of values with optional semicolon separated name-value pairs. Content-Type and Content-Disposition headers are in this format.

func SetCSP 

func SetCSP(header http.Header, args CSPArgs)

SetCSP sets a Content-Security-Policy header.

Most directives require a value. The exceptions are CSPSandbox and CSPBlockAllMixedContent.

Only special values (CSPSource* constants) need to be quoted. Don't add quotes around hosts.

Valid sources: 

CSPSource*
Hosts               example.com, *.example.com, https://example.com
Schema              data:, blob:, etc.
nonce-<val>         inline scripts using a cryptographic nonce
<hash_algo>-<val>   hash of specific script.

Also see: https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP and https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy

Example

Code:play  

package main

import (
	"net/http"

	"zgo.at/zhttp/header"
)

func main() {
	static := "static.example.com"
	headers := make(http.Header)
	header.SetCSP(headers, header.CSPArgs{
		header.CSPDefaultSrc: {header.CSPSourceNone},
		header.CSPScriptSrc:  {static},
		header.CSPStyleSrc:   {static, header.CSPSourceUnsafeInline},
		header.CSPFormAction: {header.CSPSourceSelf},
		header.CSPReportURI:  {"/csp"},
	})

}

func SetContentDisposition 

func SetContentDisposition(header http.Header, args DispositionArgs) error

SetContentDisposition sets the Content-Disposition header. Any previous value will be overwritten.

https://tools.ietf.org/html/rfc2183 https://tools.ietf.org/html/rfc6266 https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Disposition

Example

Code:play  

package main

import (
	"net/http"

	"zgo.at/zhttp/header"
)

func main() {
	headers := make(http.Header)
	header.SetContentDisposition(headers, header.DispositionArgs{
		Type:     "image/png",
		Filename: "foo.png",
	})

}

Types

type AcceptSpec 

type AcceptSpec struct {
	Value string
	Q     float64
}

AcceptSpec describes an Accept* header.

func ParseAccept 

func ParseAccept(header http.Header, key string) (specs []AcceptSpec)

ParseAccept parses Accept* headers.

type CSPArgs 

type CSPArgs map[string][]string

CSPArgs are arguments for SetCSP().

func ParseCSP 

func ParseCSP(h string) CSPArgs

func (CSPArgs) Add 

func (c CSPArgs) Add(sect string, vals ...string)

func (CSPArgs) String 

func (c CSPArgs) String() string

type DispositionArgs 

type DispositionArgs struct {
	Type     string // disposition-type
	Filename string // filename-parm

}

DispositionArgs are arguments for SetContentDisposition().

Source Files

csp.go header.go set.go

Version
v0.0.0-20250211133744-a29921896135 (latest)
Published
Feb 11, 2025
Platform
linux/amd64
Imports
7 packages
Last checked
1 month ago –

Tools for package owners.