CAPTCHAと2FAを実装

internal/middleware/security.go

@@ -7,21 +7,33 @@ import (
 )
 
 type SecurityConfig struct {
-	HTTPS bool
+	HTTPS            bool
+	TurnstileEnabled bool
 }
+
 func SecurityHeaders(config SecurityConfig) gin.HandlerFunc {
 	return func(c *gin.Context) {
 		if config.HTTPS {
 			c.Header("Strict-Transport-Security", "max-age=31536000; includeSubDomains")
 		}
 
+		scriptSrc := "'self' 'unsafe-inline' https://cdn.jsdelivr.net"
+		frameSrc := "'none'"
+		connectSrc := "'self'"
+		if config.TurnstileEnabled {
+			scriptSrc += " https://challenges.cloudflare.com"
+			frameSrc = "https://challenges.cloudflare.com"
+			connectSrc += " https://challenges.cloudflare.com"
+		}
+
 		csp := []string{
 			"default-src 'self'",
-			"script-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net",
+			"script-src " + scriptSrc,
 			"style-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net",
 			"font-src 'self' https://cdn.jsdelivr.net",
 			"img-src 'self' data:",
-			"connect-src 'self'",
+			"connect-src " + connectSrc,
+			"frame-src " + frameSrc,
 			"frame-ancestors 'none'",
 		}
 		c.Header("Content-Security-Policy", strings.Join(csp, "; "))