Skip to content
This repository has been archived by the owner on May 14, 2024. It is now read-only.

harden web security #273

Merged
merged 40 commits into from
Jan 4, 2022
Merged

harden web security #273

merged 40 commits into from
Jan 4, 2022

Commits on Nov 30, 2021

  1. adds next-secure-headers

    @abhinavkgrd
    abhinavkgrd committed Nov 30, 2021
    Configuration menu
    Copy the full SHA
    ce22b0f View commit details
    Browse the repository at this point in the history

Commits on Dec 1, 2021

  1. added clouflare headers config file

    @abhinavkgrd
    abhinavkgrd committed Dec 1, 2021
    Configuration menu
    Copy the full SHA
    ec699c1 View commit details
    Browse the repository at this point in the history

  2. test

    @abhinavkgrd
    abhinavkgrd committed Dec 1, 2021
    Configuration menu
    Copy the full SHA
    45911eb View commit details
    Browse the repository at this point in the history

  3. update csp to report only and add report URI

    @abhinavkgrd
    abhinavkgrd committed Dec 1, 2021
    Configuration menu
    Copy the full SHA
    bfd8695 View commit details
    Browse the repository at this point in the history

  4. fix csp self value , by adding quotes

    @abhinavkgrd
    abhinavkgrd committed Dec 1, 2021
    Configuration menu
    Copy the full SHA
    d297b82 View commit details
    Browse the repository at this point in the history

Commits on Dec 2, 2021

  1. changed object src to none

    @abhinavkgrd
    abhinavkgrd committed Dec 2, 2021
    Configuration menu
    Copy the full SHA
    4580470 View commit details
    Browse the repository at this point in the history

  2. move csp to meta tag in document to add inline script hash

    @abhinavkgrd
    abhinavkgrd committed Dec 2, 2021
    Configuration menu
    Copy the full SHA
    366a283 View commit details
    Browse the repository at this point in the history

  3. add Referrer-Policy header

    @abhinavkgrd
    abhinavkgrd committed Dec 2, 2021
    Configuration menu
    Copy the full SHA
    87f3f7a View commit details
    Browse the repository at this point in the history

  4. remove headers as its not passed to exported app

    @abhinavkgrd
    abhinavkgrd committed Dec 2, 2021
    Configuration menu
    Copy the full SHA
    e023474 View commit details
    Browse the repository at this point in the history

  5. better formatted csp

    @abhinavkgrd
    abhinavkgrd committed Dec 2, 2021
    Configuration menu
    Copy the full SHA
    d51335b View commit details
    Browse the repository at this point in the history

  6. add mode block to xss protection

    @abhinavkgrd
    abhinavkgrd committed Dec 2, 2021
    Configuration menu
    Copy the full SHA
    d88e64b View commit details
    Browse the repository at this point in the history

  7. make content security active

    @abhinavkgrd
    abhinavkgrd committed Dec 2, 2021
    Configuration menu
    Copy the full SHA
    25ef3a8 View commit details
    Browse the repository at this point in the history

  8. added unsafe inline as fallback to hash for script-src

    @abhinavkgrd
    abhinavkgrd committed Dec 2, 2021
    Configuration menu
    Copy the full SHA
    14094d1 View commit details
    Browse the repository at this point in the history

  9. move all directive except script-src to header

    @abhinavkgrd
    abhinavkgrd committed Dec 2, 2021
    Configuration menu
    Copy the full SHA
    4b03205 View commit details
    Browse the repository at this point in the history

  10. add missing report to and reporturi to

    @abhinavkgrd
    abhinavkgrd committed Dec 2, 2021
    Configuration menu
    Copy the full SHA
    a8ad8b2 View commit details
    Browse the repository at this point in the history

  11. remove script hash

    @abhinavkgrd
    abhinavkgrd committed Dec 2, 2021
    Configuration menu
    Copy the full SHA
    e5b9ad7 View commit details
    Browse the repository at this point in the history

  12. fix report-uri

    @abhinavkgrd
    abhinavkgrd committed Dec 2, 2021
    Configuration menu
    Copy the full SHA
    e7bed74 View commit details
    Browse the repository at this point in the history

  13. test

    @abhinavkgrd
    abhinavkgrd committed Dec 2, 2021
    Configuration menu
    Copy the full SHA
    7969d20 View commit details
    Browse the repository at this point in the history

  14. add unsafe inline to style-src 

    no good solution to implement nonce and hash exists current

styled-components/styled-components#2363

vercel/next.js#18557 (comment)
    @abhinavkgrd
    abhinavkgrd committed Dec 2, 2021
    Configuration menu
    Copy the full SHA
    59b3745 View commit details
    Browse the repository at this point in the history

  15. add back next-secure-header for local use

    @abhinavkgrd
    abhinavkgrd committed Dec 2, 2021
    Configuration menu
    Copy the full SHA
    8ce1ae7 View commit details
    Browse the repository at this point in the history

  16. added testing headers

    @abhinavkgrd
    abhinavkgrd committed Dec 2, 2021
    Configuration menu
    Copy the full SHA
    5854a94 View commit details
    Browse the repository at this point in the history

Commits on Dec 3, 2021

  1. add data: protocol for connect-src and remove require trusted for script

    @abhinavkgrd
    abhinavkgrd committed Dec 3, 2021
    Configuration menu
    Copy the full SHA
    5931bf8 View commit details
    Browse the repository at this point in the history

  2. activate content scurity policy

    @abhinavkgrd
    abhinavkgrd committed Dec 3, 2021
    Configuration menu
    Copy the full SHA
    949dd07 View commit details
    Browse the repository at this point in the history

  3. add unsafe eval to allow heif.js new Function() call

    @abhinavkgrd
    abhinavkgrd committed Dec 3, 2021
    Configuration menu
    Copy the full SHA
    5df9212 View commit details
    Browse the repository at this point in the history

  4. add sub-resource integrity

    @abhinavkgrd
    abhinavkgrd committed Dec 3, 2021
    Configuration menu
    Copy the full SHA
    e2e47d7 View commit details
    Browse the repository at this point in the history

  5. add html webpack plugin

    @abhinavkgrd
    abhinavkgrd committed Dec 3, 2021
    Configuration menu
    Copy the full SHA
    28dd87b View commit details
    Browse the repository at this point in the history

  6. run only for non server webpack

    @abhinavkgrd
    abhinavkgrd committed Dec 3, 2021
    Configuration menu
    Copy the full SHA
    82a15ef View commit details
    Browse the repository at this point in the history

  7. dont need HtmlWebpackPlugin and force enable SubresourceIntegrityPlugin

    @abhinavkgrd
    abhinavkgrd committed Dec 3, 2021
    Configuration menu
    Copy the full SHA
    f9c91cd View commit details
    Browse the repository at this point in the history

  8. remove unneccesary changes

    @abhinavkgrd
    abhinavkgrd committed Dec 3, 2021
    Configuration menu
    Copy the full SHA
    0613209 View commit details
    Browse the repository at this point in the history

  9. remove unneccasry packages

    @abhinavkgrd
    abhinavkgrd committed Dec 3, 2021
    Configuration menu
    Copy the full SHA
    20d6574 View commit details
    Browse the repository at this point in the history

  10. cleanup

    @abhinavkgrd
    abhinavkgrd committed Dec 3, 2021
    Configuration menu
    Copy the full SHA
    7df09a1 View commit details
    Browse the repository at this point in the history

  11. add suggested observatory header

    @abhinavkgrd
    abhinavkgrd committed Dec 3, 2021
    Configuration menu
    Copy the full SHA
    7b739ae View commit details
    Browse the repository at this point in the history

Commits on Dec 20, 2021

  1. update to use ente domain url for workes instead of worker.dev cf dom… 

    …ains
    @abhinavkgrd
    abhinavkgrd committed Dec 20, 2021
    Configuration menu
    Copy the full SHA
    6e62f31 View commit details
    Browse the repository at this point in the history

Commits on Jan 3, 2022

  1. update csp report URL

    @abhinavkgrd
    abhinavkgrd committed Jan 3, 2022
    Configuration menu
    Copy the full SHA
    52f0ac0 View commit details
    Browse the repository at this point in the history

  2. fix sentry tunnel URL

    @abhinavkgrd
    abhinavkgrd committed Jan 3, 2022
    Configuration menu
    Copy the full SHA
    9acb767 View commit details
    Browse the repository at this point in the history

  3. allow blob foir connect-src

    @abhinavkgrd
    abhinavkgrd committed Jan 3, 2022
    Configuration menu
    Copy the full SHA
    9c0f123 View commit details
    Browse the repository at this point in the history

  4. allow blob for script src

    @abhinavkgrd
    abhinavkgrd committed Jan 3, 2022
    Configuration menu
    Copy the full SHA
    09e4f89 View commit details
    Browse the repository at this point in the history

  5. add b2 upload URL domain to connect-src

    @abhinavkgrd
    abhinavkgrd committed Jan 3, 2022
    Configuration menu
    Copy the full SHA
    db3820a View commit details
    Browse the repository at this point in the history

Commits on Jan 4, 2022

  1. fix b2 domain for connect-src

    @abhinavkgrd
    abhinavkgrd committed Jan 4, 2022
    Configuration menu
    Copy the full SHA
    b789e62 View commit details
    Browse the repository at this point in the history

  2. change csp to report only for deployment

    @abhinavkgrd
    abhinavkgrd committed Jan 4, 2022
    Configuration menu
    Copy the full SHA
    72ed18f View commit details
    Browse the repository at this point in the history