docs(website): document the SPA Content-Security-Policy #26

wtclaude · 2026-07-21T04:03:42Z

wtclaude commented

2026-07-21 04:03:42 +00:00

Companion to RunicGateway/website#84, which implements the CSP and related security-header changes. Per the repo rule that docs/ must reflect behavior/security-contract changes, this updates the security section.

Change

website/BACKEND_DESIGN.md §6 (Auth & security): replaced the vague line

helmet with a CSP suited to the SPA (self + inline styles as needed; image sources for uploads/hero).

with the actual policy now shipped in server/src/app.js:

per-directive sources and the rationale for each non-self allowance (Google Fonts stylesheet + gstatic font files, 'unsafe-inline' for React inline styles, data:/https: images for uploads + embedded body images + BRAND_* assets, same-origin connect-src for REST + SSE);
why upgrade-insecure-requests is intentionally omitted;
the scoped looser CSP for the /api/docs Swagger UI route;
X-Powered-By handling across the public app and the two internal-only listeners.

AI disclosure

AI-assisted (Claude Code / Claude Opus 4.8). Commit carries a Co-Authored-By trailer.

🤖 Generated with Claude Code

https://claude.ai/code/session_01NgyHnrNa8WwG3doxvxjuCr

Companion to **RunicGateway/website#84**, which implements the CSP and related security-header changes. Per the repo rule that `docs/` must reflect behavior/security-contract changes, this updates the security section. ## Change `website/BACKEND_DESIGN.md` §6 (Auth & security): replaced the vague line > helmet with a CSP suited to the SPA (self + inline styles as needed; image sources for uploads/hero). with the **actual** policy now shipped in `server/src/app.js`: - per-directive sources and the rationale for each non-`self` allowance (Google Fonts stylesheet + gstatic font files, `'unsafe-inline'` for React inline styles, `data:`/`https:` images for uploads + embedded body images + `BRAND_*` assets, same-origin `connect-src` for REST + SSE); - why `upgrade-insecure-requests` is intentionally omitted; - the scoped looser CSP for the `/api/docs` Swagger UI route; - `X-Powered-By` handling across the public app and the two internal-only listeners. ## AI disclosure AI-assisted (Claude Code / Claude Opus 4.8). Commit carries a `Co-Authored-By` trailer. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01NgyHnrNa8WwG3doxvxjuCr

wtclaude added 1 commit 2026-07-21 04:03:44 +00:00

docs(website): document the SPA Content-Security-Policy 28c5c228f7

Replace the vague "helmet with a CSP suited to the SPA" line with the actual
policy now implemented in server/src/app.js: per-directive sources and the
rationale for each non-'self' allowance (Google Fonts, inline React styles,
external/embedded images, same-origin REST+SSE), why upgrade-insecure-requests
is omitted, the scoped looser CSP for the /api/docs Swagger UI route, and the
X-Powered-By handling across the public and internal listeners.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NgyHnrNa8WwG3doxvxjuCr

whitlocktech approved these changes 2026-07-21 04:03:58 +00:00

wtclaude referenced this pull request from RunicGateway/website

2026-07-21 04:04:04 +00:00

fix(security): add SPA CSP, drop x-powered-by, strengthen dedupe hash #84

whitlocktech merged commit 17f9207a17 into main

2026-07-21 04:04:04 +00:00

whitlocktech deleted branch docs/csp-security-headers

2026-07-21 04:04:05 +00:00

whitlocktech referenced this issue from a commit

2026-07-21 04:04:06 +00:00

Merge pull request 'docs(website): document the SPA Content-Security-Policy' (#26) from docs/csp-security-headers into main

wtclaude referenced this pull request