Enforce the strict web CSP (was report-only) - #7
Merged
Conversation
Promotes the strict policy from Content-Security-Policy-Report-Only to the enforced Content-Security-Policy: postbuild now REPLACES the safe-tier CSP line with the full policy (script-src pinned to inline-script hashes + scoped resource directives) instead of adding a report-only header. Validated in report-only against real traffic first: a headless public-route sweep and an authenticated Bluesky login both came back clean; the only report-only violation was Cloudflare's own Web Analytics beacon, now allowlisted via https://static.cloudflareinsights.com in script-src (its data POST is covered by connect-src https:). Follow-up to security review 2026-07-14 finding consfyi#3.
Addresses the PR#7 review: - The inline-script lookahead now requires whitespace before src= (\ssrc= not \bsrc=), so a data-src / *-src attribute isn't mistaken for a real src and skipped — a skipped inline script has no hash and would be blocked once the CSP is enforced. - The _headers rewrite uses a function replacement so a $ in the policy can't be read as a String.replace token. - New scripts/inject-csp.test.ts runs the real postbuild against throwaway build/client fixtures: inline scripts hashed, external src excluded, data-src not misclassified, enforced (no report-only) with indentation preserved, and aborts when no inline script is found. vitest include broadened to scripts/.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Promotes the strict CSP from report-only to enforced, following #6.
Since #6 merged, the strict policy ran as
Content-Security-Policy-Report-Onlyand was validated against real traffic:static.cloudflareinsights.com), external to app code.This PR:
postbuildnow replaces the enforcedContent-Security-Policywith the full strict policy (script-src 'self'+ the inline-bootstrap-script sha256 hashes, plus scoped style/img/connect/font/worker directives) instead of adding a report-only header.https://static.cloudflareinsights.cominscript-srcso the analytics beacon isn't blocked (its data POST is already covered byconnect-src https:).public/_headerskeeps the safe tier as a fallback if the build step is ever skipped — never a broken CSP.Re-verified the enforced build under
wrangler pages dev: single enforced header, zerosecuritypolicyviolationevents across list/detail/map/calendar, app fully functional (Mantine, maplibre tiles/fonts/sprites,data.cons.fyifetches all 200).