SS-FCSC/fcsc_ipi_backend
5
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

GWM : CSP

Browse Source
This commit is contained in:
Gowtham M 2025-12-18 17:22:49 +05:30
parent 581674f269
commit 8b96fe94c6
3 changed files with 24 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
app/controllers/submission.controller.js
View File

@ -885,7 +885,7 @@ exports.getBeforePreviousData = async (req, res) => {
// compute the quarter two steps before (before-previous) // compute the quarter two steps before (before-previous)
// e.g. current Q1 -> before-previous = Q3 (year - 1) // e.g. current Q1 -> before-previous = Q3 (year - 1)
// current Q4 -> before-previous = Q2 (same year) // current Q4 -> before-previous = Q2 (same year)
let beforePrevQuarterNum = currentQuarterNum - 2; let beforePrevQuarterNum = currentQuarterNum - 1;
let targetYear = yearNum; let targetYear = yearNum;
if (beforePrevQuarterNum <= 0) { if (beforePrevQuarterNum <= 0) {
beforePrevQuarterNum += 4; beforePrevQuarterNum += 4;

8
app/routes/routes.js
View File

@ -57,8 +57,8 @@ const upload = multer({ dest: UPLOAD_DIR });
* description: Manage notification templates * description: Manage notification templates
* - name: Quarterly Windows Configuration * - name: Quarterly Windows Configuration
* description: Manage quarterly windows configuration master data * description: Manage quarterly windows configuration master data
* - name: Establishment Password Reset Requests * - name: Establishment Pwd Reset Requests
* description: Manage Establishment Password Reset Requests * description: Manage Establishment Pwd Reset Requests
* - name: Master * - name: Master
* description: * description:
*/ */
@ -2782,8 +2782,8 @@ router.post("/forgot-password/request-otp", establishmentController.forgotPasswo
* @swagger * @swagger
* /api/forgot-password/verify-otp: * /api/forgot-password/verify-otp:
* post: * post:
* summary: Verify OTP and reset establishment user password * summary: Verify OTP and reset establishment user Pwd
* tags: [Establishment Password Reset Requests] * tags: [Establishment Pwd Reset Requests]
* requestBody: * requestBody:
* required: true * required: true
* content: * content:

31
server.js
View File

@ -16,31 +16,38 @@ const app = express();
// REQUIRED for HSTS when behind proxy (AWS ALB / Nginx / Cloudflare) // REQUIRED for HSTS when behind proxy (AWS ALB / Nginx / Cloudflare)
app.set("trust proxy", 1); app.set("trust proxy", 1);
const isLocal = process.env.NODE_ENV === "development";
// GLOBAL MIDDLEWARE (body parsing) // GLOBAL MIDDLEWARE (body parsing)
app.use(express.json()); app.use(express.json());
app.use(cookieParser()); app.use(cookieParser());
// HELMET const isLocal = process.env.NODE_ENV === "development";
app.use( app.use(
helmet({ helmet({
contentSecurityPolicy: false, contentSecurityPolicy: {
directives: {
defaultSrc: ["'none'"],
connectSrc: ["'self'"],
scriptSrc: ["'self'", "'unsafe-inline'"],
styleSrc: ["'self'", "'unsafe-inline'"],
imgSrc: ["'self'", "data:"],
fontSrc: ["'self'", "data:"],
frameAncestors: ["'none'"],
baseUri: ["'none'"],
formAction: ["'self'"],
},
},
}) })
); );
// prevent framing (clickjacking protection) // Clickjacking protection
app.use( app.use(helmet.frameguard({ action: "deny" }));
helmet.frameguard({
action: "deny",
})
);
//HSTS (ENABLE FOR UAT + PROD) // HSTS for UAT + PROD
if (!isLocal) { if (!isLocal) {
app.use( app.use(
helmet.hsts({ helmet.hsts({
maxAge: 31536000, // 1 year maxAge: 31536000,
includeSubDomains: true, includeSubDomains: true,
preload: true, preload: true,
}) })