thePR0M3TH3AN/bitlogin
1
0 Fork 0
mirror of https://github.com/PR0M3TH3AN/bitlogin.git synced 2026-10-27 08:31:21 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix live login: allow WASM compilation under the deployment CSP

Browse Source 
script-src 'self' alone forbids WebAssembly.compile, and Argon2id
(hash-wasm) compiles a WASM module in the crypto worker -- so the CSP
added in the second-audit hardening broke every password flow on the
deployed site. Add 'wasm-unsafe-eval', which permits WASM compilation
only; JS eval stays banned, and the policy test now pins both facts so
neither can regress silently.

Co-Authored-By: Claude Fable 5 <[email protected]>
This commit is contained in:
thePR0M3TH3ANandClaude Fable 5 committed 2026-08-04 09:55:49 -04:00
1 parent 0fec9c4182
commit 6b10f0b902
2 files changed
+11 -1
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

packages/widget/src/securityPolicy.test.ts
+10
View File
@@ -79,6 +79,16 @@ describe("widget security policy", () => {
expect(headers.get("Content-Security-Policy")).toContain(
"frame-ancestors 'none'",
);
// Argon2id (hash-wasm) compiles a WASM module inside the crypto worker;
// script-src without 'wasm-unsafe-eval' blocks WebAssembly.compile and
// breaks every password flow on the deployed site. The keyword permits
// WASM compilation ONLY -- plain 'unsafe-eval' (JS eval) must stay out.
expect(headers.get("Content-Security-Policy")).toContain(
"script-src 'self' 'wasm-unsafe-eval'",
);
expect(headers.get("Content-Security-Policy")).not.toContain(
" 'unsafe-eval'",
);
for (const required of [
"X-Content-Type-Options",
"Referrer-Policy",
vercel.json
+1 -1
View File
@@ -7,7 +7,7 @@
"headers": [
{
"key": "Content-Security-Policy",
"value": "default-src 'none'; script-src 'self'; worker-src 'self'; connect-src 'self' wss:; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self'; manifest-src 'self'; base-uri 'none'; form-action 'self'; frame-ancestors 'none'; object-src 'none'; upgrade-insecure-requests"
"value": "default-src 'none'; script-src 'self' 'wasm-unsafe-eval'; worker-src 'self'; connect-src 'self' wss:; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self'; manifest-src 'self'; base-uri 'none'; form-action 'self'; frame-ancestors 'none'; object-src 'none'; upgrade-insecure-requests"
},
{ "key": "X-Content-Type-Options", "value": "nosniff" },
{ "key": "Referrer-Policy", "value": "no-referrer" },