Skip to content

Frontend: nginx.conf CSP allows unsafe-inline styles — weakens XSS protection unnecessarily #192

Description

@k-deejah

Difficulty: Advanced

Problem

1. frontend/nginx.conf CSP includes style-src 'self' 'unsafe-inline'
The Content-Security-Policy header at line 14 of frontend/nginx.conf allows inline styles: style-src 'self' 'unsafe-inline'. Tailwind CSS generates class-based styles — no inline style="..." attributes or <style> tags are needed in the built output. The 'unsafe-inline' directive is therefore unnecessary and weakens the CSP's defense against CSS injection attacks.

2. CSP script-src only allows 'self' — but Vite-built bundles may require sha256 hashes for inline initialization scripts
script-src 'self' blocks all inline scripts. Vite may emit a small inline initialization script in the built index.html for module preloading or environment variable injection. If this script runs and is blocked by CSP, the app will fail silently in production with no browser error displayed to users.

3. No CSP connect-src directive — fetch requests to the backend API are not explicitly allowed
The CSP has no connect-src directive, meaning fetch/XHR requests are governed by default-src 'self'. If the backend API runs on a different origin or port (e.g., http://localhost:4000 in development or https://api.lineproof.com in production), those requests will be blocked by the CSP in a production deployment.

Impact: 'unsafe-inline' in style-src provides no value and weakens XSS protection. Missing connect-src will silently break all API calls in production. A CSP violation during Vite script loading will crash the app.

Proposed Solution

  • Remove 'unsafe-inline' from style-src (Tailwind does not need it in production builds).
  • Add connect-src 'self' ${API_URL} using an nginx environment variable or a build-time substitution.
  • Run a Vite build and inspect the output for any inline scripts; if present, generate the correct sha256 hash and add it to script-src.
  • Test the CSP with Report-Only mode before enforcing.

Acceptance Criteria

  • 'unsafe-inline' removed from style-src in nginx.conf
  • connect-src directive added allowing the backend API origin
  • Vite build output inspected for inline scripts and CSP updated accordingly
  • App loads without any CSP violation in browser console
  • CSP header includes report-uri or report-to endpoint for violation reporting
  • docs/deployment-strategy.md updated with CSP configuration guidance

Contributor Note

If assigned, your PR must show the browser Network tab with the CSP header applied, and confirm no CSP violations in the browser console for the production build. Show any inline scripts found in the Vite build output.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions