feat(viewer): add defense-in-depth security headers - #735
Merged
Conversation
Wrap the local viewer with a middleware that sets a strict Content-Security-Policy (default-src 'self', no unsafe-inline) plus X-Content-Type-Options, X-Frame-Options, Referrer-Policy, and Permissions-Policy on every response. HSTS is intentionally omitted since the viewer serves plain HTTP on loopback. To keep the CSP strict without an 'unsafe-inline' relaxation, the formerly-inline session script is externalized to static/session.js (it uses no template variables). Update the assurance case with a CWE-79 countermeasure row documenting these headers. Adds tests covering header presence, HSTS omission, and CSP strictness.
Contributor
|
🔍 OpenCodeReview found 1 issue(s) in this PR.
|
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
|
|
||
| srv := &http.Server{ | ||
| Addr: addr, | ||
| Handler: guarded, |
| {{end}} | ||
| </div> | ||
|
|
||
| <script> |
| }); | ||
| el.innerHTML = html; | ||
| }); | ||
| </script> |
5 tasks
14 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Adds a security-headers middleware to the local web viewer, setting the following on every response:
default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; object-src 'none'; base-uri 'none'; frame-ancestors 'none'; form-action 'none'nosniffDENYno-referrergeolocation=(), camera=(), microphone=()To keep the CSP strict (no
unsafe-inline), the previously-inline<script>insession.html— which uses no template variables — is externalized tostatic/session.jsand served as a first-party asset.Why
The viewer exposes session JSONL that contains reviewed source code and the LLM's analysis of it. These headers add defense-in-depth against content injection and clickjacking on the viewer's browser-facing surface, complementing the existing DNS-rebinding host-header allowlist.
HSTS is intentionally omitted: the viewer serves plain HTTP on loopback, where HSTS is meaningless and would wrongly pin
localhost.Changes
internal/viewer/securityheaders.go— new middleware, wrapped outermost inStartServerinternal/viewer/static/session.js— externalized session scriptinternal/viewer/templates/session.html— reference external scriptinternal/viewer/server.go— embedsession.js, wire up middlewareinternal/viewer/securityheaders_test.go— header presence, HSTS omission, CSP strictnessASSURANCE_CASE.md— new CWE-79 (XSS) countermeasure rowTesting
gofmt -s -lcleango build ./...passesgo test ./internal/viewer/passes