mORMot Open Source

itSDS

Member

From: Germany

Registered: 2014-04-24

Posts: 544

Question: Modifying OutCustomHeaders in GetViewInfo ?

Hi Arnaud, i like to add a different nonce for CSP to every call of GetViewInfo
Acually I put my CSP to OutCustomHeaders in HttpServer Request.

is it Possible to Access / Modify the Ctxt.OutCustomHeaders from MVCApplication ?

Thank you

---

Rad Studio 12.3 Athens

ab

Administrator

From: France

Registered: 2010-06-21

Posts: 14,946

Website

Re: Question: Modifying OutCustomHeaders in GetViewInfo ?

You can set a callback e.g. to TRestServer.OnAfterUri to change the output.

ttomas

Member

Registered: 2013-03-08

Posts: 140

Re: Question: Modifying OutCustomHeaders in GetViewInfo ?

For MVC app you can add parameter CustomOutHttpHeader to your public methods. @ab add this future when I need  response header for htmx application.

procedure TMyMVCApplication.Test(... , out CustomOutHttpHeader: RawUtf8); 
begin
  ...
  CustomOutHttpHeader := 'HX-Retarget: #dialog';
end;

itSDS

Member

From: Germany

Registered: 2014-04-24

Posts: 544

Re: Question: Modifying OutCustomHeaders in GetViewInfo ?

ty i'll try

---

Rad Studio 12.3 Athens

itSDS

Member

From: Germany

Registered: 2014-04-24

Posts: 544

Re: Question: Modifying OutCustomHeaders in GetViewInfo ?

I think both Variants are to complicated. I genereate ContentSecurityPolicy in GetViewInfo which generates 2 Nonce Values for script and style
This both values i give to mustache {{main.cspnonce}}

if i use callback it is called after mvc, how could i add my nonces to main.xy ?
if i use ttomas version i have to add my code to every function, i have a lot

To make it easy, i made a little patch to TRestUriParams and added a new value: ContentSecurityPolicy

   LowLevelUserAgent: RawUtf8;
    /// itSDS: für ContentSecurityPolicy !
    ContentSecurityPolicy: RawUtf8; // itSDS
    /// initialize the non RawUtf8 values
    procedure Init; overload;

Then i added a little bit of code to mormot.rest.http.server.pas

  call.LowLevelUserAgent := Ctxt.UserAgent;
  call.ContentSecurityPolicy := ''; // itSDS
  if fHosts.Count > 0 then

  Ctxt.OutCustomHeaders := call.OutHead;

  if call.ContentSecurityPolicy <> '' then // itSDS
    Ctxt.AddOutHeader(['Content-Security-Policy: ', call.ContentSecurityPolicy]);

  if call.OutInternalState <> 0 then

what do you think ?

Last edited by itSDS (2025-03-21 10:10:28)

---

Rad Studio 12.3 Athens

ab

Administrator

From: France

Registered: 2010-06-21

Posts: 14,946

Website

Re: Question: Modifying OutCustomHeaders in GetViewInfo ?

The TRestUriParams structure should be kept small and with minimal fields.
This ContentSecurityPolicy field is too dedicated to my understanding.

I don't understand how and where you set your ContentSecurityPolicy.ContentSecurityPolicy field.
Why not just use:

AppendLine(call.OutHead, ['Content-Security-Policy: ', MyContentSecurityPolicy]);