app/routes/api.csp-report.ts

Functions

Imports

It imports app/lib/client-ip.ts, app/lib/context.ts, app/lib/rate-limit.mjs. No module of this repo imports it.

Source

1import { receiveCspReport } from "@dustinedwards/site-runtime/csp-report";
2import { clientIp } from "~/lib/client-ip";
3import { getEnv } from "~/lib/context";
4import { limitHit } from "~/lib/rate-limit.mjs";
5
6import type { Route } from "./+types/api.csp-report";
7
8/**
9 * The CSP violation sink the policy names: the family's one receiver (site-runtime's csp-report).
10 * A public, unauthenticated POST, since browsers send reports without credentials. It answers every
11 * POST 204 (an error status makes browsers retry), reads at most 16 KB, logs at most 10 violations as
12 * trimmed JSON lines (origin and path only; no address, user agent or cookie) and never writes D1,
13 * which would hand the internet a storage-exhaustion primitive. Anything but POST and OPTIONS is 405.
14 * The security set is applied by workers/app.ts, as on every response.
15 */
16
17/** Loose, because a page tripping ten rules sends ten. */
18const RATE_LIMIT = 60;
19const RATE_PERIOD_SECONDS = 60;
20
21function receive(request: Request, context: Route.ActionArgs["context"]) {
22  const env = getEnv(context);
23  return receiveCspReport(request, {
24    // Keyed on the edge-set client IP, not the body, which the client controls. A missing or
25    // unavailable counter drops the report (still 204): this site's limiter refuses when it cannot count.
26    allow: async (r) =>
27      Boolean(env.ASK_BUDGET) &&
28      (await limitHit(env, `csp:${clientIp(r)}`, RATE_LIMIT, RATE_PERIOD_SECONDS)).status === "ok",
29  });
30}
31
32export function action({ request, context }: Route.ActionArgs) {
33  return receive(request, context);
34}
35
36export function loader({ request, context }: Route.LoaderArgs) {
37  return receive(request, context);
38}