From 3c7cb2229809d4f28fea8d2f9d7a1a67cbd094f3 Mon Sep 17 00:00:00 2001
From: lbenedar <lbenedar@local.lab>
Date: Thu, 5 Mar 2026 18:11:34 +0300
Subject: [PATCH] ch10.2

---
 cmd/web/main.go       |  2 +-
 cmd/web/middleware.go | 12 ++++++------
 cmd/web/routes.go     |  2 +-
 3 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/cmd/web/main.go b/cmd/web/main.go
index 5659352..112d24a 100644
--- a/cmd/web/main.go
+++ b/cmd/web/main.go
@@ -74,7 +74,7 @@ func main() {
 	}
 
 	infoLog.Printf("Starting server on %s", cfg.addr)
-	err = srv.ListenAndServe()
+	err = srv.ListenAndServeTLS("./tls/cert.pem", "./tls/key.pem")
 	errorLog.Fatal(err)
 }
 
diff --git a/cmd/web/middleware.go b/cmd/web/middleware.go
index d4ffad3..818c2ab 100644
--- a/cmd/web/middleware.go
+++ b/cmd/web/middleware.go
@@ -7,12 +7,12 @@ import (
 
 func secureHeaders(next http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.Header().Set("Content-Security-Policy",
-			"default-src 'self'; style-src 'self' fonts.googleapis.com; font-src fonts.gstatic.com")
-		w.Header().Set("Referrer-Policy", "origin-when-cross-origin")
-		w.Header().Set("X-Content-Type-Options", "nosniff")
-		w.Header().Set("X-Frame-Options", "deny")
-		w.Header().Set("X-XSS-Protection", "0")
+		//w.Header().Set("Content-Security-Policy",
+		//	"default-src 'self'; style-src 'self' fonts.googleapis.com; font-src fonts.gstatic.com")
+		//w.Header().Set("Referrer-Policy", "origin-when-cross-origin")
+		//w.Header().Set("X-Content-Type-Options", "nosniff")
+		//w.Header().Set("X-Frame-Options", "deny")
+		//w.Header().Set("X-XSS-Protection", "0")
 
 		next.ServeHTTP(w, r)
 	})
diff --git a/cmd/web/routes.go b/cmd/web/routes.go
index e98fc6e..4d88313 100644
--- a/cmd/web/routes.go
+++ b/cmd/web/routes.go
@@ -15,7 +15,7 @@ func (app *application) routes() http.Handler {
 	})
 
 	fileServer := http.FileServer(http.Dir("./ui/static/"))
-	router.Handler(http.MethodGet, "/static/", http.StripPrefix("/static", fileServer))
+	router.Handler(http.MethodGet, "/static/*filepath", http.StripPrefix("/static", fileServer))
 
 	dynamic := alice.New(app.sessionManager.LoadAndSave)