Changeset fe9164f in Klonkt

Timestamp:

06/28/2026 02:15:48 PM (2 months ago)

Author:

Robin Genis <roboburr@…>

Branches:

main

Children:

f1627b6

Parents:

a8b4f10

Message:

chore(csp): default-src 'none' (deny by default) + explicit manifest-src/worker-src

Tightens CSP to deny-by-default; the PWA manifest + service worker (previously covered by the
implicit default-src 'self') are listed explicitly so they keep working.

File:

• src/server.js (modified) (2 diffs)

src/server.js

@@ -99 +99 @@
   contentSecurityPolicy: {
     directives: {
-      defaultSrc: ["'self'"],
+      defaultSrc: ["'none'"],
       // Strict CSP: a per-request nonce + 'strict-dynamic' (no 'unsafe-inline', no broad host
       // sources — securityheaders/Observatory flag those). Trusted (nonce'd) scripts may load
@@ -132 +132 @@
       // renderPage — it shows untrusted remote content next to the interact buttons.
       frameSrc: ["'self'", "https:"],
+      // default-src is 'none' (deny by default), so resource types that were implicitly covered
+      // by the old default-src 'self' must be listed explicitly: the PWA manifest and the
+      // service worker. (base-uri/form-action/frame-ancestors/object-src 'none' come from
+      // Helmet's defaults; img/style/connect/media/font/frame are set above.)
+      manifestSrc: ["'self'"],
+      workerSrc: ["'self'", "blob:"],
     },
   },