mirror of
https://github.com/PR0M3TH3AN/bitlogin.git
synced 2026-10-27 08:31:21 +00:00
thePR0M3TH3ANandClaude Fable 5
6b10f0b902
script-src 'self' alone forbids WebAssembly.compile, and Argon2id (hash-wasm) compiles a WASM module in the crypto worker -- so the CSP added in the second-audit hardening broke every password flow on the deployed site. Add 'wasm-unsafe-eval', which permits WASM compilation only; JS eval stays banned, and the policy test now pins both facts so neither can regress silently. Co-Authored-By: Claude Fable 5 <[email protected]>
25 lines
1.1 KiB
JSON
25 lines
1.1 KiB
JSON
{
|
|
"buildCommand": "npm run build -w @bitlogin/core && npm run build -w @bitlogin/widget && npm run build -w @bitlogin/demo",
|
|
"outputDirectory": "packages/demo/dist",
|
|
"headers": [
|
|
{
|
|
"source": "/(.*)",
|
|
"headers": [
|
|
{
|
|
"key": "Content-Security-Policy",
|
|
"value": "default-src 'none'; script-src 'self' 'wasm-unsafe-eval'; worker-src 'self'; connect-src 'self' wss:; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self'; manifest-src 'self'; base-uri 'none'; form-action 'self'; frame-ancestors 'none'; object-src 'none'; upgrade-insecure-requests"
|
|
},
|
|
{ "key": "X-Content-Type-Options", "value": "nosniff" },
|
|
{ "key": "Referrer-Policy", "value": "no-referrer" },
|
|
{
|
|
"key": "Permissions-Policy",
|
|
"value": "camera=(), microphone=(), geolocation=(), payment=(), usb=()"
|
|
},
|
|
{ "key": "Cross-Origin-Opener-Policy", "value": "same-origin" },
|
|
{ "key": "Cross-Origin-Resource-Policy", "value": "same-origin" },
|
|
{ "key": "X-Frame-Options", "value": "DENY" }
|
|
]
|
|
}
|
|
]
|
|
}
|