package web

import (
	"html/template"
	"net/http"

	"code.cloudfoundry.org/lager"
)

type templateData struct{}

type handler struct {
	logger   lager.Logger
	template *template.Template
}

func NewHandler(logger lager.Logger) (http.Handler, error) {
	tfuncs := &templateFuncs{
		assetIDs: map[string]string{},
	}

	funcs := template.FuncMap{
		"asset": tfuncs.asset,
	}

	src, err := Asset("index.html")
	if err != nil {
		return nil, err
	}

	t, err := template.New("index").Funcs(funcs).Parse(string(src))
	if err != nil {
		return nil, err
	}

	return &handler{
		logger:   logger,
		template: t,
	}, nil
}

func (h *handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
	log := h.logger.Session("index")

	err := h.template.Execute(w, templateData{})
	if err != nil {
		log.Fatal("failed-to-build-template", err, lager.Data{})
		w.WriteHeader(http.StatusInternalServerError)
	}
}

package web

import (
	"html/template"
	"net/http"

	"code.cloudfoundry.org/lager"
)

type templateData struct{}

type handler struct {
	logger   lager.Logger
	template *template.Template
}

func NewHandler(logger lager.Logger) (http.Handler, error) {
	tfuncs := &templateFuncs{
		assetIDs: map[string]string{},
	}

	funcs := template.FuncMap{
		"asset": tfuncs.asset,
	}

	src, err := Asset("index.html")
	if err != nil {
		return nil, err
	}

	t, err := template.New("index").Funcs(funcs).Parse(string(src))
	if err != nil {
		return nil, err
	}

	return &handler{
		logger:   logger,
		template: t,
	}, nil
}

func (h *handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
	log := h.logger.Session("index")

	err := h.template.Execute(w, templateData{})

	if err != nil {
		log.Fatal("failed-to-build-template", err, lager.Data{})
		w.WriteHeader(http.StatusInternalServerError)
	}

}

Add X- headers for security
Add X- headers for security

X-XSS, X-Content-Type-Options, X-Download-Options have sane defaults,
but X-Frame-Options would break existing functionality of including
concourse on iframes if we added this header by default.

Instead, we expose what to put in this header in the ATC flags,
defaulting it to no header.

[#141162059]

Signed-off-by: Anisha Hirji <234e666d587164a63e127013ae06c9fdf954d431@pivotal.io>
