Security Hardening: Implement CSP, COOP, Frame Protection & Trusted Types to Improve Browser Security Baseline

[ayyushh-18]

Description

Overview

Lighthouse Best Practices audit has identified multiple high-severity browser security gaps that weaken the application's overall security posture. These findings indicate missing document-level security controls and browser isolation mechanisms that are considered modern web security standards.

While the application remains functional, the absence of these protections increases exposure to client-side attacks such as Cross-Site Scripting (XSS), Clickjacking, and Cross-Origin exploitation.

---

Current Findings

High Severity Security Issues

• No Content Security Policy (CSP) found in enforcement mode
• No Cross-Origin-Opener-Policy (COOP) header found
• No frame control policy found (X-Frame-Options / frame-ancestors)
• No Trusted Types directive configured in CSP

Additional Observations

• Third-party cookies detected from Google Identity Services
• Browser Issues Panel reports unresolved security-related warnings
• Missing security hardening headers that are recommended by Lighthouse

---

Expected Improvements

Content Security Policy (CSP)

• Configure a strict CSP in enforcement mode
• Restrict execution of untrusted scripts
• Reduce the risk of XSS attacks

Cross-Origin Isolation

• Implement COOP headers
• Improve browsing context isolation
• Reduce cross-origin interaction risks

Clickjacking Protection

• Configure X-Frame-Options
  OR
• Add frame-ancestors directive in CSP
• Prevent unauthorized embedding of application pages

Trusted Types Integration

• Enable Trusted Types policy
• Protect DOM sinks from unsafe data injection
• Improve resistance against DOM-based XSS vulnerabilities

---

Acceptance Criteria

• Lighthouse Best Practices score improves significantly
• CSP is enabled in enforcement mode
• COOP header is properly configured
• Frame protection policy is implemented
• Trusted Types directive is configured where applicable
• Existing authentication and third-party integrations continue to function correctly
• No regressions introduced in production builds
• Security headers are documented for future maintenance

---

Impact

Implementing these security controls will establish a stronger browser security baseline, improve Lighthouse Best Practices compliance, and align the application with modern web security recommendations while maintaining compatibility with existing functionality.

---

Supporting Evidence

Lighthouse Audit Report

The identified security and best-practice issues are documented in the attached Lighthouse audit report.

agloforge.pdf

• Lighthouse Best Practices Report (PDF)

Relevant Findings from the Report

• Best Practices Score: 77
• No Content Security Policy (CSP) found in enforcement mode
• No Cross-Origin-Opener-Policy (COOP) header found
• No frame control policy found
• No Trusted Types directive configured
• Third-party cookies detected
• Security-related warnings reported in Chrome DevTools Issues panel

Reference

Please refer to the attached PDF report for complete audit details, severity indicators, and Lighthouse diagnostics used to identify the above findings.

[ayyushh-18]

Hi @Rishabhworkspace,

I would like to work on this issue under SSoC'26.

After reviewing the Lighthouse audit report and the reported security findings, I have identified the affected areas and have a clear implementation plan for addressing the missing browser security headers and hardening configurations while ensuring compatibility with existing application functionality.

The work will involve:

• Implementing and validating Content Security Policy (CSP)
• Configuring Cross-Origin-Opener-Policy (COOP)
• Adding frame protection mechanisms (X-Frame-Options / frame-ancestors)
• Evaluating Trusted Types integration
• Verifying Lighthouse Best Practices improvements and preventing regressions

Please assign this issue to me under the SSoC'26 program with Hard difficulty.

Thank you.

[Rishabhworkspace]

assigned to @ayyushh-18 make sure to star the repo