fix(frontend): harden CSP — drop style-src unsafe-inline, add connect-src and violation reporting (Closes #192) - #219
Open
waterWang wants to merge 1 commit into
Conversation
…-src and violation reporting - Remove 'unsafe-inline' from style-src in frontend/nginx.conf; the codebase now renders without inline style attributes (ProgressBar uses the CSSOM, QueuesPage card layout moved to the .queue-card stylesheet class) - Add connect-src with the backend API origin () plus Stellar Horizon/Soroban RPC endpoints used at runtime - Add frame-ancestors, base-uri, form-action directives and CSP violation reporting (report-uri / Reporting-Endpoints) - Verified the Vite production build emits no inline scripts, so script-src 'self' requires no sha256 hash allowlist - Document the CSP policy, API-origin override and rollout guidance in docs/deployment-strategy.md Closes Stellar-Deejah#192
|
@waterWang is attempting to deploy a commit to the Deejah Team on Vercel. A member of the Team first needs to authorize it. |
Open
6 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Hardens the frontend Content-Security-Policy in
frontend/nginx.confper issue #192:'unsafe-inline'fromstyle-src— Tailwind emits class-based styles, and the two inlinestyleusages in the codebase have been removed:ProgressBarnow sets its fill width via the CSSOM (element.style.width) inside auseEffect, which is not affected by CSP style-src.QueuesPagecard layout hints (content-visibility,contain-intrinsic-size) moved into a.queue-cardstylesheet class inglobal.css.connect-src— allows the backend API origin (nginx$api_originvariable, defaults tohttp://localhost:4000) plus the Stellar Horizon and Soroban RPC endpoints the frontend speaks to at runtime.frame-ancestors 'none',base-uri 'self',form-action 'self', plusreport-uri/Reporting-Endpointsfor server-side violation reporting.Inline scripts audit
Ran a production Vite build and inspected the output — the built
dist/index.htmlcontains no inline scripts:All scripts/styles/fonts load from
src-allowed external sources, soscript-src 'self'needs nosha256-*hash allowlist. Google Fonts are explicitly allowed viastyle-src https://fonts.googleapis.comandfont-src https://fonts.gstatic.com.Verification
vite build— 1652 modules, built successfully in 2.75stsc --noEmit— cleanvitest run— 10 test files / 40 tests all passDocs
docs/deployment-strategy.mdgained a CSP section documenting the policy, the API-origin override, violation reporting, and a Report-Only → enforcement rollout guide.Browser check (for maintainers)
When deployed, the Network tab should show the new CSP header (
add_header Content-Security-Policy "…style-src 'self' https://fonts.googleapis.com;…"), and the browser console should be free of CSP violations for the production build.Closes #192