fix(web): add Content-Security-Policy header to bunyip-web responses (BUNYIP-232) #260
Loading…
Reference in a new issue
No description provided.
Delete branch "fix/bunyip-232-web-csp-header"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
bunyip-web emitted every security header except Content-Security-Policy (the edge proxy stamps HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy but no CSP). Add a tower-http SetResponseHeaderLayer that stamps a CSP scoped to what the Maud + htmx SSR pages actually load: inline scripts/styles and onclick handlers ('unsafe-inline'), htmx from unpkg.com, the Font Awesome kit, the Google Fonts stylesheet/font CDNs, and the browser-facing bunyip-api origin in connect-src so the dashboard EventSource is not blocked. frame-ancestors 'none' and form-action 'self' lock down framing and form posts; SSO works because it is driven by top-level navigations, which CSP does not constrain.
The layer uses if_not_present so it does not clobber the admin attachment route's stricter Content-Security-Policy: sandbox. Adds tests asserting the CSP is present on responses, carries the expected directives, and leaves a handler-set policy untouched.
#BUNYIP-232
bunyip-web emitted every security header except Content-Security-Policy (the edge proxy stamps HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy but no CSP). Add a tower-http SetResponseHeaderLayer that stamps a CSP scoped to what the Maud + htmx SSR pages actually load: inline scripts/styles and onclick handlers ('unsafe-inline'), htmx from unpkg.com, the Font Awesome kit, the Google Fonts stylesheet/font CDNs, and the browser-facing bunyip-api origin in connect-src so the dashboard EventSource is not blocked. frame-ancestors 'none' and form-action 'self' lock down framing and form posts; SSO works because it is driven by top-level navigations, which CSP does not constrain. The layer uses if_not_present so it does not clobber the admin attachment route's stricter Content-Security-Policy: sandbox. Adds tests asserting the CSP is present on responses, carries the expected directives, and leaves a handler-set policy untouched. #BUNYIP-232