handlers: add func addHeaders

handlers/error.go

@@ -8,6 +8,8 @@ import (
 )
 
 func renderErrorPage(c echo.Context, status int, statusText, error string) error {
+	addHeaders(c)
+
 	strStatus := strconv.Itoa(status)
 
 	return c.Render(

handlers/handlers.go

@@ -22,6 +22,8 @@ func Index() echo.HandlerFunc {
 			return c.Redirect(http.StatusFound, "/home")
 		}
 
+		addHeaders(c)
+
 		csrf := c.Get("csrf").(string)
 
 		err := c.Render(
@@ -50,6 +52,10 @@ func Index() echo.HandlerFunc {
 	}
 }
 
+func addHeaders(c echo.Context) {
+	c.Response().Writer.Header().Set("Cross-Origin-Opener-Policy", "same-origin")
+}
+
 // experimental global redirect handler?
 // http.HandleFunc("/redirect", func(w http.ResponseWriter, r *http.Request) {
 // loc, err := url.QueryUnescape(r.URL.Query().Get("loc"))

handlers/home.go

@@ -14,6 +14,8 @@ func Home(client *ent.Client) echo.HandlerFunc {
 	return func(c echo.Context) error {
 		var username string
 
+		addHeaders(c)
+
 		sess, _ := session.Get(setting.SessionCookieName(), c)
 		if sess == nil {
 			log.Info("no session, redirecting to /signin", "endpoint", "/home")

handlers/logout.go

@@ -9,6 +9,8 @@ import (
 
 func Logout() echo.HandlerFunc {
 	return func(c echo.Context) error {
+		addHeaders(c)
+
 		switch {
 		case c.Request().Method == "POST":
 			sess, _ := session.Get(setting.SessionCookieName(), c)

handlers/signin.go

@@ -15,6 +15,8 @@ import (
 
 func Signin() echo.HandlerFunc {
 	return func(c echo.Context) error {
+		addHeaders(c)
+
 		sess, _ := session.Get(setting.SessionCookieName(), c)
 
 		username := sess.Values["username"]
@@ -38,6 +40,8 @@ func Signin() echo.HandlerFunc {
 
 func SigninPost(client *ent.Client) echo.HandlerFunc {
 	return func(c echo.Context) error {
+		addHeaders(c)
+
 		err := c.Request().ParseForm()
 		if err != nil {
 			return err

handlers/signup.go

@@ -14,6 +14,8 @@ import (
 
 func Signup() echo.HandlerFunc {
 	return func(c echo.Context) error {
+		addHeaders(c)
+
 		sess, _ := session.Get(setting.SessionCookieName(), c)
 		if sess != nil {
 			log.Info("gorilla session", "endpoint", "signup")
@@ -69,6 +71,8 @@ func Signup() echo.HandlerFunc {
 
 func SignupPost(client *ent.Client) echo.HandlerFunc {
 	return func(c echo.Context) error {
+		addHeaders(c)
+
 		err := c.Request().ParseForm()
 		if err != nil {
 			return err