wtclaude
e1461d9161
Address SonarQube security hotspots on the website: - server/src/app.js: replace `contentSecurityPolicy: false` with a helmet CSP tuned for the built React SPA (script-src 'self'; style-src adds 'unsafe-inline' for React inline styles + the Google Fonts stylesheet; font-src gstatic; img-src allows data:/https: for uploads, embedded body images and BRAND_* assets; connect-src 'self' for REST+SSE). upgrade-insecure-requests is intentionally omitted (TLS terminates at the proxy; keeps local `npm start` over http working). The /api/docs Swagger UI route gets a scoped looser policy (inline script/style) since swagger-ui-express injects an inline bootstrap. - client/vite.config.js: disable the inline module-preload polyfill so code-split builds keep `script-src 'self'` valid (RichTextEditor is a separate chunk). - bot/src/app.js, server/src/internalApp.js: disable x-powered-by on the two internal-only listeners (the public app already strips it via helmet). - shardEvents dedupe key: SHA-1 -> SHA-256 truncated to 40 hex chars (fits the existing CHAR(40) column, no migration; it is a content fingerprint, not a security value). schema.sql comment updated to match. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NgyHnrNa8WwG3doxvxjuCr
24 lines
835 B
JavaScript
24 lines
835 B
JavaScript
import { defineConfig } from 'vite'
|
|
import react from '@vitejs/plugin-react'
|
|
|
|
// In dev, proxy the API + uploads to the Express server so the SPA stays
|
|
// same-origin (cookies work) and matches the production setup where Express
|
|
// serves the built client.
|
|
export default defineConfig({
|
|
plugins: [react()],
|
|
server: {
|
|
port: 5173,
|
|
proxy: {
|
|
'/api': { target: 'http://127.0.0.1:3000', changeOrigin: true },
|
|
'/uploads': { target: 'http://127.0.0.1:3000', changeOrigin: true },
|
|
},
|
|
},
|
|
build: {
|
|
outDir: 'dist',
|
|
// Don't inject the inline module-preload polyfill script — modern browsers all
|
|
// support modulepreload, and an inline <script> would violate the server's
|
|
// `script-src 'self'` CSP (see server/src/app.js). Keeps builds inline-free.
|
|
modulePreload: { polyfill: false },
|
|
},
|
|
})
|