Add security hardening

api/internal/httpapi/server.go

@@ -38,18 +38,20 @@ func (s *Server) Handler() http.Handler {
 	mux.HandleFunc("GET /api/clients", s.clients)
 	mux.HandleFunc("GET /api/blocks", s.blocks)
 	mux.HandleFunc("GET /api/snapshot", s.snapshot)
-	mux.HandleFunc("GET /api/ws", s.handleWS)
+	// The WebSocket handshake is exempt from the same-origin policy, so
+	// it is origin-checked like the mutating routes below.
+	mux.HandleFunc("GET /api/ws", s.sameOrigin(s.handleWS))
 	mux.HandleFunc("GET /api/admin/debug-blocks", s.debugBlocks)
-	mux.HandleFunc("POST /api/admin/reset-latency", s.resetLatency)
-	mux.HandleFunc("POST /api/admin/ack-best", s.ackBest)
-	mux.HandleFunc("POST /api/admin/reset-ack-best", s.resetAckBest)
-	mux.HandleFunc("POST /api/admin/rebuild-share-stats", s.rebuildShareStats)
-	mux.HandleFunc("POST /api/accelerate", s.accelerate)
-	mux.HandleFunc("POST /api/accelerate/cancel", s.accelerateCancel)
-	mux.HandleFunc("POST /api/accelerate/max", s.accelerateMax)
+	mux.HandleFunc("POST /api/admin/reset-latency", s.sameOrigin(s.resetLatency))
+	mux.HandleFunc("POST /api/admin/ack-best", s.sameOrigin(s.ackBest))
+	mux.HandleFunc("POST /api/admin/reset-ack-best", s.sameOrigin(s.resetAckBest))
+	mux.HandleFunc("POST /api/admin/rebuild-share-stats", s.sameOrigin(s.rebuildShareStats))
+	mux.HandleFunc("POST /api/accelerate", s.sameOrigin(s.accelerate))
+	mux.HandleFunc("POST /api/accelerate/cancel", s.sameOrigin(s.accelerateCancel))
+	mux.HandleFunc("POST /api/accelerate/max", s.sameOrigin(s.accelerateMax))
 	mux.HandleFunc("GET /api/accelerate/list", s.accelerateList)
 	mux.Handle("/", spaHandler(webui.FS()))
-	return mux
+	return securityHeaders(mux)
 }
 
 // spaHandler serves static files from the embedded dist tree and