Comprehensive security hardening for self-hosted deployments

.github/workflows/build-test.yml

@@ -19,10 +19,10 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
 
       - name: Set up Node.js
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@v4
         with:
           node-version: "22"
 

.github/workflows/docker-build.yml

@@ -18,8 +18,8 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v2
-      - uses: actions/setup-node@v3
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
         with:
           node-version: "22"
       - run: npm install
@@ -52,7 +52,7 @@ jobs:
 
       - name: Build and push image with branch/commit tags (push events)
         if: github.event_name == 'push'
-        uses: docker/build-push-action@v2
+        uses: docker/build-push-action@v6
         with:
           context: .
           file: ./docker/Dockerfile
@@ -68,7 +68,7 @@ jobs:
 
       - name: Build and push image with release tag (release events only)
         if: github.event_name == 'release'
-        uses: docker/build-push-action@v2
+        uses: docker/build-push-action@v6
         with:
           context: .
           file: ./docker/Dockerfile

.gitignore

@@ -8,6 +8,11 @@ npm-debug.log*
 yarn-debug.log*
 yarn-error.log*
 
+# environment / secrets
+.env
+.env.local
+.env.*.local
+
 # build
 dist
 *tar.gz

__tests__/middlewares/authConfig.test.ts

@@ -96,8 +96,9 @@ describe("AuthConfig", () => {
       next = jest.fn()
     })
 
-    test("calls next() if demo_auth cookie is true", () => {
-      req.headers!.cookie = "demo_auth=true"
+    test("calls next() if demo_auth cookie is valid signed value", () => {
+      const signed = AuthConfig.signDemoCookie()
+      req.headers!.cookie = `demo_auth=${signed}`
       AuthConfig.checkDemoCookie(req as Request, res as Response, next)
       expect(next).toHaveBeenCalled()
       expect(res.status).not.toHaveBeenCalled()
@@ -110,16 +111,17 @@ describe("AuthConfig", () => {
       expect(next).not.toHaveBeenCalled()
     })
 
-    test("returns 401 if demo_auth cookie is not true", () => {
-      req.headers!.cookie = "demo_auth=false"
+    test("returns 401 if demo_auth cookie is invalid", () => {
+      req.headers!.cookie = "demo_auth=forged_value"
       AuthConfig.checkDemoCookie(req as Request, res as Response, next)
       expect(res.status).toHaveBeenCalledWith(401)
       expect(res.send).toHaveBeenCalledWith("Unauthorized")
       expect(next).not.toHaveBeenCalled()
     })
 
-    test("handles multiple cookies and still calls next() when demo_auth=true", () => {
-      req.headers!.cookie = "other=123; demo_auth=true; another=456"
+    test("handles multiple cookies and still calls next() when demo_auth is valid", () => {
+      const signed = AuthConfig.signDemoCookie()
+      req.headers!.cookie = `other=123; demo_auth=${signed}; another=456`
       AuthConfig.checkDemoCookie(req as Request, res as Response, next)
       expect(next).toHaveBeenCalled()
       expect(res.status).not.toHaveBeenCalled()

__tests__/middlewares/headers.test.ts

@@ -34,7 +34,7 @@ describe("headers middleware", () => {
     )
     expect(res.setHeader).toHaveBeenCalledWith(
       "Referrer-Policy",
-      "no-referrer-when-downgrade"
+      "strict-origin-when-cross-origin"
     )
     expect(res.setHeader).toHaveBeenCalledWith(
       "Permissions-Policy",

__tests__/staticmaps/renderer.markers.test.ts

@@ -209,6 +209,7 @@ describe("loadMarkers", () => {
     const arrayBuffer = new Uint8Array([1, 2, 3]).buffer
     ;(global.fetch as jest.Mock).mockResolvedValue({
       ok: true,
+      headers: { get: (name: string) => name === "content-type" ? "image/png" : null },
       arrayBuffer: jest.fn().mockResolvedValue(arrayBuffer),
     })
 
@@ -220,7 +221,7 @@ describe("loadMarkers", () => {
 
     expect(global.fetch).toHaveBeenCalledWith(
       "https://example.com/marker.png",
-      { method: "GET" }
+      expect.objectContaining({ method: "GET", redirect: "manual" })
     )
     expect(sharpMock).toHaveBeenCalled()
     expect(sharpInstance.resize).toHaveBeenCalledWith(10, 15)

public/demo.css

@@ -0,0 +1,90 @@
+body {
+  font-family: system-ui, sans-serif;
+  margin: 0;
+  padding: 1.5rem;
+  background: #f8fafc;
+  color: #1e293b;
+  max-width: 1200px;
+  margin: 0 auto;
+  display: grid;
+  gap: 1rem;
+}
+
+p {
+  margin: 0;
+  font-size: 0.9rem;
+}
+
+h1 {
+  margin: 0;
+  font-size: 1.5rem;
+}
+
+#map {
+  width: 100%;
+  height: 400px;
+  border-radius: 0.75rem;
+  overflow: hidden;
+  box-shadow: 0 2px 6px rgba(0, 0, 0, 0.15);
+}
+
+.controls {
+  margin-top: 1rem;
+  display: flex;
+  gap: 0.5rem;
+  flex-wrap: wrap;
+}
+
+button {
+  padding: 0.6rem 1.2rem;
+  border: none;
+  border-radius: 0.5rem;
+  background: #3b82f6;
+  color: #fff;
+  font-size: 0.95rem;
+  cursor: pointer;
+  transition: background 0.2s;
+}
+
+button:hover {
+  background: #2563eb;
+}
+
+#basemapSelect {
+  padding: 0.6rem 1.2rem;
+  border: none;
+  border-radius: 0.5rem;
+  background: #3b82f6;
+  color: #fff;
+  font-size: 0.95rem;
+  cursor: pointer;
+  transition: background 0.2s;
+  font-family: system-ui, sans-serif;
+}
+
+#basemapSelect:hover,
+#basemapSelect:focus {
+  background: #2563eb;
+  outline: none;
+}
+
+#basemapSelect option {
+  color: #fff;
+  background: #3b82f6;
+  font-size: 0.95rem;
+}
+
+#staticMapUrlDisplay {
+  font-family: monospace;
+  color: #0f172a;
+  word-break: break-all;
+}
+
+img.static-map {
+  margin-top: 1rem;
+  width: 100%;
+  max-height: 400px;
+  border-radius: 0.75rem;
+  object-fit: cover;
+  box-shadow: 0 2px 6px rgba(0, 0, 0, 0.15);
+}

public/index.html

@@ -5,99 +5,7 @@
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <title>docker-staticmaps demo</title>
     <link rel="stylesheet" href="ol.css" />
-    <style>
-      body {
-        font-family: system-ui, sans-serif;
-        margin: 0;
-        padding: 1.5rem;
-        background: #f8fafc;
-        color: #1e293b;
-        max-width: 1200px;
-        margin: 0 auto;
-        display: grid;
-        gap: 1rem;
-      }
-
-
-      p {
-        margin: 0;
-        font-size: 0.9rem;
-      }
-
-      h1 {
-        margin: 0;
-        font-size: 1.5rem;
-      }
-
-      #map {
-        width: 100%;
-        height: 400px;
-        border-radius: 0.75rem;
-        overflow: hidden;
-        box-shadow: 0 2px 6px rgba(0, 0, 0, 0.15);
-      }
-
-      .controls {
-        margin-top: 1rem;
-        display: flex;
-        gap: 0.5rem;
-        flex-wrap: wrap;
-      }
-
-      button {
-        padding: 0.6rem 1.2rem;
-        border: none;
-        border-radius: 0.5rem;
-        background: #3b82f6;
-        color: #fff;
-        font-size: 0.95rem;
-        cursor: pointer;
-        transition: background 0.2s;
-      }
-
-      button:hover {
-        background: #2563eb;
-      }
-
-      #basemapSelect {
-        padding: 0.6rem 1.2rem;
-        border: none;
-        border-radius: 0.5rem;
-        background: #3b82f6;
-        color: #fff;
-        font-size: 0.95rem;
-        cursor: pointer;
-        transition: background 0.2s;
-        font-family: system-ui, sans-serif;
-      }
-
-      #basemapSelect:hover,
-      #basemapSelect:focus {
-        background: #2563eb;
-        outline: none;
-      }
-
-      /* Dropdown options styling */
-      #basemapSelect option {
-        color: #fff;
-        background: #3b82f6;
-        font-size: 0.95rem;
-      }
-
-      #staticMapUrlDisplay {
-        font-family: monospace;
-        color: #0f172a;
-      }
-
-      img.static-map {
-        margin-top: 1rem;
-        width: 100%;
-        max-height: 400px;
-        border-radius: 0.75rem;
-        object-fit: cover;
-        box-shadow: 0 2px 6px rgba(0, 0, 0, 0.15);
-      }
-    </style>
+    <link rel="stylesheet" href="demo.css" />
   </head>
   <body>
     <h1>github.com/dietrichmax/docker-staticmaps demo</h1>
@@ -114,8 +22,7 @@ <h1>github.com/dietrichmax/docker-staticmaps demo</h1>
 
     <p>
       <strong>Current Static Map URL:</strong>
-      <span id="staticMapUrlDisplay" style="word-break: break-all"
-        >/staticmaps?</span
+      <span id="staticMapUrlDisplay">/staticmaps?</span
       >
     </p>