diff options
| author | Leitwolf11 | 2026-11-06 08:05:21 +0300 |
|---|---|---|
| committer | Leitwolf11 | 2026-11-06 08:05:21 +0300 |
| commit | c4fb3effa7f806c570771bb83c0ed6988006bc24 (patch) | |
| tree | 6e5e9b36161934b3e646ea21ccc00407cf29ba0f /docs/ARCHITECTURE.md | |
| parent | 35e09214817585007308bdbc26d877791843ab29 (diff) | |
| download | progmaweb-security/content-security-policy.tar.gz | |
Give every page a Content-Security-Policy with its own noncesecurity/content-security-policy
The pages of progmasoft.com and its hosts had no content security
policy. The proxy now creates a 128-bit nonce for every request and sends
the policy both ways: on the request, so that Next marks its own inline
scripts with the nonce, and on the response. The layout reads the nonce
for the theme bootstrap. Every page is rendered on demand already, so
none is served with a stale nonce.
Scripts may come from the host, carry the nonce, or be Cloudflare's Web
Analytics beacon from static.cloudflareinsights.com, which reports to
cloudflareinsights.com. 'strict-dynamic' is left out, because browsers
ignore host sources under it and the beacon is added by Cloudflare
without a nonce. Styles allow inline ones; objects, framing and other
base URLs are refused. There is no form-action: sign-in and OAuth
consent end in redirects to other hosts, loopback addresses included,
and browsers apply form-action to them. The development server also
gets 'unsafe-eval' for its hot reload.
Tests check the nonce and each directive; ARCHITECTURE.md describes the
policy.
Diffstat (limited to 'docs/ARCHITECTURE.md')
| -rw-r--r-- | docs/ARCHITECTURE.md | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/docs/ARCHITECTURE.md b/docs/ARCHITECTURE.md index b2b46d6..f5c812b 100644 --- a/docs/ARCHITECTURE.md +++ b/docs/ARCHITECTURE.md @@ -103,7 +103,10 @@ task, not a public route. ## Response headers Nginx adds HSTS, `X-Content-Type-Options`, `X-Frame-Options: DENY`, a referrer policy and a permissions policy on -every host. Next.js sets the same content headers for the responses it produces. The API sets its own, stricter set: +every host. Next.js sets the same content headers for the responses it produces, and its proxy gives every page a +content security policy with a nonce of its own (`apps/web/lib/content-security-policy.ts`): scripts come from the +host, carry the nonce, or are Cloudflare's Web Analytics beacon; nothing may frame a page, and there is no +`form-action`, because sign-in and consent end in redirects to other hosts. The API sets its own, stricter set: a content security policy that allows nothing, `Cache-Control: no-store`, and no referrer. ## Shared account identity |