Enable Play security http headers

CHANGELOG.md

@@ -11,7 +11,7 @@ For upgrade instructions, please check the [migration guide](MIGRATIONS.md).
 
 ### Added
 
--
+- Improved security by enabling http security headers [#3084](https://github.com/scalableminds/webknossos/pull/3084)
 
 ### Changed
 

conf/application.conf

@@ -162,6 +162,10 @@ silhouette {
   }
 }
 
+play.http.filters = "com.scalableminds.webknossos.datastore.Filters"
+# we do not want to set *all* of the security filters, though:
+play.filters.headers.contentSecurityPolicy = null
+play.filters.headers.contentTypeOptions = null
 
 operatorData = """
   **scalable minds UG (haftungsbeschränkt) & Co. KG**

project/Dependencies.scala

@@ -74,6 +74,7 @@ object Dependencies {
     grpc,
     grpcServices,
     scalapbRuntimeGrpc,
+    filters,
     component("play-test")
   )
 

webknossos-datastore/app/com/scalableminds/webknossos/datastore/Filters.scala

@@ -0,0 +1,10 @@
+package com.scalableminds.webknossos.datastore
+
+import javax.inject.Inject
+
+import play.api.http.HttpFilters
+import play.filters.headers.SecurityHeadersFilter
+
+class Filters @Inject() (securityHeadersFilter: SecurityHeadersFilter) extends HttpFilters {
+  def filters = Seq(securityHeadersFilter)
+}

webknossos-datastore/conf/standalone-datastore.conf

@@ -56,3 +56,8 @@ pidfile.path = "/dev/null"
 # other settings
 play.http.parser.maxMemoryBuffer=250M
 play.http.parser.maxDiskBuffer=1G
+
+play.http.filters = "com.scalableminds.webknossos.datastore.Filters"
+# we do not want to set *all* of the security filters, though:
+play.filters.headers.contentSecurityPolicy = null
+play.filters.headers.contentTypeOptions = null