kaslo/pawkey-sk
1
0
Fork 0
mirror of https://git.boykissers.com/pawkey/pawkey-sk.git synced 2025-12-20 12:14:18 +00:00
Code Packages Activity

merge: Set X-Robots-Tag to disable indexing API endpoints (resolves #756) (!1119)

Browse Source 
View MR for information: https://activitypub.software/TransFem-org/Sharkey/-/merge_requests/1119

Closes #756

Approved-by: dakkar <dakkar@thenautilus.net>
Approved-by: Marie <github@yuugi.dev>
This commit is contained in:
dakkar
2025-06-14 16:09:40 +00:00
parent a9a7e4b9d0 b44abe0eaa
commit 96263dd93d
5 changed files with 23 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
packages/backend/src/server/ActivityPubServerService.ts
View File

@@ -791,6 +791,10 @@ export class ActivityPubServerService {
reply.header('Access-Control-Allow-Origin', '*'); reply.header('Access-Control-Allow-Origin', '*');
reply.header('Access-Control-Expose-Headers', 'Vary'); reply.header('Access-Control-Expose-Headers', 'Vary');
// Tell crawlers not to index AP endpoints.
// https://developers.google.com/search/docs/crawling-indexing/block-indexing
reply.header('X-Robots-Tag', 'noindex');
/* tell any caching proxy that they should not cache these /* tell any caching proxy that they should not cache these
responses: we wouldn't want the proxy to return a 403 to responses: we wouldn't want the proxy to return a 403 to
someone presenting a valid signature, or return a cached someone presenting a valid signature, or return a cached

4
packages/backend/src/server/FileServerService.ts
View File

@@ -70,6 +70,10 @@ export class FileServerService {
fastify.addHook('onRequest', (request, reply, done) => { fastify.addHook('onRequest', (request, reply, done) => {
reply.header('Content-Security-Policy', 'default-src \'none\'; img-src \'self\'; media-src \'self\'; style-src \'unsafe-inline\''); reply.header('Content-Security-Policy', 'default-src \'none\'; img-src \'self\'; media-src \'self\'; style-src \'unsafe-inline\'');
reply.header('Access-Control-Allow-Origin', '*'); reply.header('Access-Control-Allow-Origin', '*');
// Tell crawlers not to index files endpoints.
// https://developers.google.com/search/docs/crawling-indexing/block-indexing
reply.header('X-Robots-Tag', 'noindex');
done(); done();
}); });

4
packages/backend/src/server/api/ApiCallService.ts
View File

@@ -148,6 +148,10 @@ export class ApiCallService implements OnApplicationShutdown {
request: FastifyRequest<{ Body: Record<string, unknown> | undefined, Querystring: Record<string, unknown> }>, request: FastifyRequest<{ Body: Record<string, unknown> | undefined, Querystring: Record<string, unknown> }>,
reply: FastifyReply, reply: FastifyReply,
): void { ): void {
// Tell crawlers not to index API endpoints.
// https://developers.google.com/search/docs/crawling-indexing/block-indexing
reply.header('X-Robots-Tag', 'noindex');
const body = request.method === 'GET' const body = request.method === 'GET'
? request.query ? request.query
: request.body; : request.body;

7
packages/backend/src/server/api/mastodon/MastodonApiServerService.ts
View File

@@ -71,6 +71,13 @@ export class MastodonApiServerService {
done(); done();
}); });
// Tell crawlers not to index API endpoints.
// https://developers.google.com/search/docs/crawling-indexing/block-indexing
fastify.addHook('onRequest', (request, reply, done) => {
reply.header('X-Robots-Tag', 'noindex');
done();
});
// External endpoints // External endpoints
this.apiAccountMastodon.register(fastify); this.apiAccountMastodon.register(fastify);
this.apiAppsMastodon.register(fastify); this.apiAppsMastodon.register(fastify);

4
packages/backend/src/server/web/UrlPreviewService.ts
View File

@@ -125,6 +125,10 @@ export class UrlPreviewService {
reply: FastifyReply, reply: FastifyReply,
): Promise<void> { ): Promise<void> {
if (!this.meta.urlPreviewEnabled) { if (!this.meta.urlPreviewEnabled) {
// Tell crawlers not to index URL previews.
// https://developers.google.com/search/docs/crawling-indexing/block-indexing
reply.header('X-Robots-Tag', 'noindex');
return reply.code(403).send({ return reply.code(403).send({
error: { error: {
message: 'URL preview is disabled', message: 'URL preview is disabled',