mark
/
msos
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

security: enforce Content-Security-Policy #13

Merged
popovskik merged 1 commits from kristijan-dev into develop 2026-08-04 08:48:52 +00:00
Conversation 0 Commits 1 Files Changed 1 +10 -3
popovskik commented 2026-08-04 08:48:25 +00:00
Collaborator
Copy Link

Switches CSP report-only -> enforcing with a browser-verified allowlist (0 violations). Adds Google Fonts, Font Awesome, MailerLite, and the Forms endpoint that the old policy was missing.

🤖 Generated with Claude Code

Switches CSP report-only -> enforcing with a browser-verified allowlist (0 violations). Adds Google Fonts, Font Awesome, MailerLite, and the Forms endpoint that the old policy was missing. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
popovskik added 1 commit 2026-08-04 08:48:26 +00:00
9877b4bbd6 security(.htaccess): enforce Content-Security-Policy (was report-only) 
Switch CSP from Report-Only to enforcing, with an allowlist verified in a
browser against a server sending this exact header (0 violations across the
homepage, a YouTube project page, the assistant, MailerLite JSONP, GA/gtag,
and the Google Forms endpoint).

Adds the sources the old report-only policy was missing (and would have
broken if enforced blindly): Google Fonts (style/font), Font Awesome cdnjs
(style/font), MailerLite newsletter (script/connect), the Google Forms
endpoint in connect-src, plus object-src 'none'. Keeps 'unsafe-inline' for
the in-<head> consent bootstrap; the host allowlists + form-action/base-uri
are the real hardening on top of existing output escaping.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
popovskik added 1 commit 2026-08-04 08:48:27 +00:00
9877b4bbd6 security(.htaccess): enforce Content-Security-Policy (was report-only) 
Switch CSP from Report-Only to enforcing, with an allowlist verified in a
browser against a server sending this exact header (0 violations across the
homepage, a YouTube project page, the assistant, MailerLite JSONP, GA/gtag,
and the Google Forms endpoint).

Adds the sources the old report-only policy was missing (and would have
broken if enforced blindly): Google Fonts (style/font), Font Awesome cdnjs
(style/font), MailerLite newsletter (script/connect), the Google Forms
endpoint in connect-src, plus object-src 'none'. Keeps 'unsafe-inline' for
the in-<head> consent bootstrap; the host allowlists + form-action/base-uri
are the real hardening on top of existing output escaping.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
popovskik merged commit c092e65ae0 into develop 2026-08-04 08:48:52 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No Label
Milestone
Clear milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
No Assignees
1 Participants
Notifications
Due Date
The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: mark/msos#13
No description provided.
Delete Branch "kristijan-dev"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?