workers/security-headers.ts

Functions

Imports

It imports no other module of this repo. Imported by workers/app.ts, workers/csp-report.ts.

Source

1// Every security header Carrel sends, in one place: the portfolio's shared set from
2// @dustinedwards/site-runtime (the OWASP Secure Headers Project's own values), Carrel's few
3// deviations beside the reason for each, and the Content-Security-Policy built from the short list of
4// what Carrel loads. workers/app.ts applies it to every response on both hosts, redirects and the
5// gate's refusals included. Nothing else in the repo sets a security header, except a route that
6// chooses its own policy on purpose (the preview, the print export), which is kept.
7
8import { buildContentSecurityPolicy, buildPolicy, generateNonce, reportingEndpoints } from "@dustinedwards/site-runtime/csp";
9import { applyHeaderSet, buildSecurityHeaders } from "@dustinedwards/site-runtime/headers";
10
11/** Where browsers send violation reports: a path on the AI door, the one Carrel host outside Access. */
12export const CSP_REPORT_PATH = "/csp-report";
13/** The `report-to` group name, declared by the Reporting-Endpoints header. */
14const CSP_REPORT_GROUP = "csp";
15
16/** The browser host's set: the shared standard exactly. A header not overridden is OSHP's value. */
17const securityHeaders: Readonly<Record<string, string>> = Object.freeze(buildSecurityHeaders());
18
19/** The AI door's set: the standard with one deviation. */
20export const doorSecurityHeaders: Readonly<Record<string, string>> = Object.freeze(
21  buildSecurityHeaders({
22    overrides: {
23      "Cross-Origin-Opener-Policy": {
24        value: null,
25        reason:
26          "AI clients (claude.ai among them) open /authorize in a popup and wait for it through window.opener; same-origin would sever that opener and the sign-in would never return.",
27      },
28    },
29  }),
30);
31
32/** A nonce from the platform's randomness; a derived or fixed value would pass every test and protect nothing. */
33export const newNonce = generateNonce;
34
35/** An image origin as a policy may name it; anything else is dropped rather than failing every page. */
36const isHttpsOrigin = (origin: string) => /^https:\/\/[^\s;,'"]+$/.test(origin);
37
38/**
39 * The policy for every page Carrel renders. Every response is private and `no-store`, so a fresh
40 * nonce per request is sound; it goes on React Router's scripts and on CodeMirror's inline <style>,
41 * which cannot be turned off.
42 *
43 * `imageOrigins` are the configured sites' origins: the media library and the editor show each file
44 * from the site that serves it, and nothing else may load an image. `reportOrigin` is the AI door's
45 * origin, whose /csp-report is reachable without an Access session.
46 */
47export function appPolicy(nonce: string, imageOrigins: string[] = [], reportOrigin = ""): string {
48  return buildContentSecurityPolicy({
49    nonce,
50    sources: {
51      // 'strict-dynamic': the nonced entry scripts load the route chunks.
52      script: ["'strict-dynamic'"],
53      img: ["data:", ...imageOrigins.filter(isHttpsOrigin)],
54    },
55    // The editor's palettes are placed with style attributes, which nonces do not cover.
56    styleAttributesInline: true,
57    // Carrel's hosts are excluded from Web Analytics, and HTML is sent no-transform, so the beacon is
58    // never injected: the policy is not loosened for it.
59    cloudflareWebAnalytics: false,
60    // The preview iframe, which is Carrel's own route serving the site's page under its own policy.
61    extraDirectives: ["frame-src 'self'"],
62    reportUri: `${reportOrigin}${CSP_REPORT_PATH}`,
63    reportTo: CSP_REPORT_GROUP,
64  }).value;
65}
66
67/**
68 * The AI door's policy. Its only page is the consent form, which has one inline <style> and no
69 * script. form-action is left out on purpose: approving submits into a redirect chain (POST
70 * /authorize, the Access sign-in, /callback, then the client's own redirect_uri), a browser checks
71 * form-action on every hop, and the last hop is whatever any client names, so no list can be right
72 * (capsid shipped form-action 'self' on its consent page and broke sign-in for 26 days).
73 */
74export const DOOR_POLICY = buildPolicy([
75  "default-src 'none'",
76  "style-src 'unsafe-inline'",
77  "base-uri 'none'",
78  "frame-ancestors 'none'",
79  `report-uri ${CSP_REPORT_PATH}`,
80  `report-to ${CSP_REPORT_GROUP}`,
81]);
82
83/** The response itself when its headers can be changed, else a copy that can (Response.redirect's cannot). */
84function mutable(response: Response): Response {
85  try {
86    response.headers.set("X-Content-Type-Options", "nosniff");
87    return response;
88  } catch {
89    return new Response(response.body, { status: response.status, statusText: response.statusText, headers: new Headers(response.headers) });
90  }
91}
92
93function apply(response: Response, set: Readonly<Record<string, string>>, policy: string, reportOrigin: string): Response {
94  const out = mutable(response);
95  // The preview alone may be framed, and only by Carrel itself: its route says SAMEORIGIN, and nothing
96  // a route says can loosen framing further than that.
97  const framedByCarrel = out.headers.get("X-Frame-Options")?.trim().toUpperCase() === "SAMEORIGIN";
98  // A route that set its own policy (the sandboxed preview, the print export) keeps it.
99  const ownPolicy = out.headers.has("Content-Security-Policy");
100  applyHeaderSet(out.headers, set);
101  if (framedByCarrel) out.headers.set("X-Frame-Options", "SAMEORIGIN");
102  if (!ownPolicy) out.headers.set("Content-Security-Policy", policy);
103  if (reportOrigin) out.headers.set("Reporting-Endpoints", reportingEndpoints(CSP_REPORT_GROUP, new URL(CSP_REPORT_PATH, reportOrigin)));
104  return out;
105}
106
107/** Every response on the browser host: the shared set and the app policy for this request's nonce. */
108export function withSecurityHeaders(
109  response: Response,
110  nonce: string,
111  { imageOrigins = [], reportOrigin = "" }: { imageOrigins?: string[]; reportOrigin?: string } = {},
112): Response {
113  return apply(response, securityHeaders, appPolicy(nonce, imageOrigins, reportOrigin), reportOrigin);
114}
115
116/** Every response on the AI door: its set and its policy. */
117export function withDoorSecurityHeaders(response: Response, doorOrigin: string): Response {
118  return apply(response, doorSecurityHeaders, DOOR_POLICY, doorOrigin);
119}