mirror of
https://github.com/narrrl/narl-workspace.git
synced 2026-11-03 16:41:27 +01:00
nvrl
8da0a30497
Nothing set a CSP, a referrer policy, nosniff or a framing rule, so the app relied entirely on the same-origin policy. The referrer policy is the one with a concrete leak behind it: a share token is part of the URL path, so following any outbound link from a shared entry handed a third party a working link to a private entry. `no-referrer` closes that. The layer is `if_not_present`, so the media routes keep the stricter sandbox CSP they set for themselves.
35 lines
1.0 KiB
TOML
35 lines
1.0 KiB
TOML
[package]
|
|
name = "narl-diary"
|
|
version = "0.1.0"
|
|
edition = "2021"
|
|
description = "A terminal-themed personal diary for the browser"
|
|
|
|
[dependencies]
|
|
axum = { version = "0.8", features = ["multipart", "macros"] }
|
|
tokio = { version = "1", features = ["rt-multi-thread", "macros", "signal", "fs"] }
|
|
tower = "0.5"
|
|
tokio-util = { version = "0.7", features = ["io"] }
|
|
tower-http = { version = "0.6", features = ["trace", "compression-gzip", "limit", "set-header"] }
|
|
sqlx = { version = "0.8", default-features = false, features = ["runtime-tokio", "sqlite", "migrate", "macros"] }
|
|
serde = { version = "1", features = ["derive"] }
|
|
serde_json = "1"
|
|
tracing = "0.1"
|
|
tracing-subscriber = { version = "0.3", features = ["env-filter"] }
|
|
dotenvy = "0.15"
|
|
uuid = { version = "1", features = ["v4"] }
|
|
rand = "0.8"
|
|
hmac = "0.12"
|
|
sha2 = "0.10"
|
|
base64 = "0.22"
|
|
subtle = "2"
|
|
mime_guess = "2"
|
|
rust-embed = { version = "8", features = ["interpolate-folder-path"] }
|
|
regex = "1"
|
|
anyhow = "1"
|
|
|
|
[profile.release]
|
|
opt-level = 3
|
|
lto = true
|
|
codegen-units = 1
|
|
strip = true
|