feat: Add Content-Security-Policy meta tag for GitHub Pages #596
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -7,20 +7,59 @@ const {themes} = require('prism-react-renderer'); | |
| require('dotenv').config(); | ||
| /** @type {import('@docusaurus/types').Config} */ | ||
|
|
||
| // Content Security Policy directives for GitHub Pages (meta tag based) | ||
| // Note: Report-Only mode and frame-ancestors are not supported via meta tags, only via HTTP headers | ||
| // This policy is enforced directly - test thoroughly before deployment | ||
| const cspDirectives = [ | ||
| "default-src 'self'", | ||
| // Scripts: 'unsafe-inline' required for Docusaurus theme init, gtag, and runtime scripts | ||
| "script-src 'self' 'unsafe-inline' https://www.google-analytics.com https://www.googletagmanager.com", | ||
| // Styles: 'unsafe-inline' required for react-select Emotion CSS-in-JS | ||
| "style-src 'self' 'unsafe-inline'", | ||
|
There was a problem hiding this comment. The
Contributor
Author
There was a problem hiding this comment. This is something we are going to need to accept if we continue to use Docusaurus and GitHub pages. |
||
| // Images: Google Analytics pixel tracking | ||
| "img-src 'self' data: https://www.google-analytics.com https://www.googletagmanager.com", | ||
| // Fonts: Self-hosted only (Inter, Plus Jakarta Sans) | ||
| "font-src 'self'", | ||
| // API connections: Algolia search, Google Analytics (includes regional endpoints) | ||
| "connect-src 'self' https://www.google-analytics.com https://*.google-analytics.com https://www.googletagmanager.com https://*.algolia.net https://*.algolianet.com", | ||
RichardSlater marked this conversation as resolved.
Show resolved
Hide resolved
|
||
| // Embedded frames: YouTube for ReactPlayer video embeds | ||
| "frame-src 'self' https://www.youtube.com https://www.youtube-nocookie.com", | ||
| // Form submissions | ||
| "form-action 'self'", | ||
| // Base URI restriction | ||
| "base-uri 'self'", | ||
| // Object/embed elements (Flash, etc.) - not needed | ||
| "object-src 'none'", | ||
| // Upgrade insecure requests | ||
| "upgrade-insecure-requests" | ||
| ].join('; '); | ||
|
|
||
| const config = { | ||
| title: "Ensono Stacks", | ||
| tagline: | ||
| "Helping projects gain momentum on digital transformation, with opinionated and modular boilerplate solutions", | ||
| url: "https://stacks.ensono.com", | ||
| baseUrl: "/", | ||
| baseUrlIssueBanner: false, // Disabled to reduce inline scripts for CSP | ||
| trailingSlash: false, | ||
| onBrokenLinks: "warn", | ||
| favicon: "img/icons/favicon.ico", | ||
| // Content Security Policy meta tag for GitHub Pages | ||
| headTags: [ | ||
| { | ||
| tagName: "meta", | ||
| attributes: { | ||
| "http-equiv": "Content-Security-Policy", | ||
| content: cspDirectives, | ||
| }, | ||
| }, | ||
| ], | ||
| organizationName: "Ensono", // Usually your GitHub org/user name. | ||
| projectName: "amido.github.io", // Usually your repo name. | ||
| customFields: { | ||
| description: | ||
| "Ensono Stacks is a catalogue of workload templates that\n" + | ||
| "instantly scaffold and deploy boilerplate software projects. Slash the time it takes to get productive on your software project.", | ||
| keywords: [ | ||
| "Microsoft Azure", | ||
| "Google Cloud Platform", | ||
|
|
@@ -50,7 +89,7 @@ const config = { | |
| appId: process.env.ALGOLIA_APP_ID, | ||
| apiKey: process.env.ALGOLIA_API_KEY, | ||
| indexName: process.env.ALGOLIA_INDEX_NAME, | ||
| }, | ||
| }, | ||
| themeConfig: { | ||
| colorMode: { | ||
|
|
@@ -59,7 +98,14 @@ const config = { | |
| prism: { | ||
| theme: themes.github, | ||
| darkTheme: themes.vsDark, | ||
| additionalLanguages: [ | ||
| "csharp", | ||
| "docker", | ||
| "powershell", | ||
| "java", | ||
| "bash", | ||
| "json", | ||
| ], | ||
| }, | ||
| navbar: { | ||
| title: "", | ||
|
|
@@ -69,7 +115,7 @@ const config = { | |
| href: "/", | ||
| width: 150, | ||
| height: 36, | ||
| className: "custom-navbar-logo-class", | ||
| }, | ||
| items: [ | ||
| { | ||
|
|
@@ -84,19 +130,19 @@ const config = { | |
| { | ||
| href: "https://www.ensono.com/company/lets-connect/", | ||
| label: "Connect", | ||
| position: "right", | ||
| }, | ||
| ], | ||
| }, | ||
| footer: { | ||
| links: [ | ||
| { | ||
| title: "Documentation", | ||
| items: [ | ||
| { | ||
| label: "Getting Started", | ||
| to: "docs/", | ||
| }, | ||
| ], | ||
| }, | ||
| { | ||
|
|
@@ -133,27 +179,27 @@ const config = { | |
| "@docusaurus/preset-classic", | ||
| { | ||
| docs: { | ||
| sidebarPath: require.resolve("./sidebars.js"), | ||
| remarkPlugins: [remarkImages.default || remarkImages], | ||
| }, | ||
| theme: { | ||
| customCss: require.resolve("./src/css/custom.css"), | ||
| }, | ||
| sitemap: { | ||
| changefreq: "weekly", | ||
| priority: 0.5, | ||
| }, | ||
| gtag: { | ||
| trackingID: "G-EKCQBC5CSJ", | ||
| anonymizeIP: true, // Should IPs be anonymized? (optional) | ||
| }, | ||
| googleAnalytics: { | ||
| trackingID: "G-EKCQBC5CSJ", | ||
| anonymizeIP: true, // Should IPs be anonymized? | ||
| }, | ||
| }, | ||
| ], | ||
| ], | ||
| }; | ||
|
|
||
| module.exports = config; | ||
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The
'unsafe-inline'directive inscript-srcsignificantly weakens XSS protection. Consider using nonces or hashes for inline scripts instead. If Docusaurus requires inline scripts, document this as a known security trade-off with a plan to migrate to CSP Level 3 nonces when feasible.There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Docusaurus doesn't support this, possibly could be mitigated by another engine (Hugo), however due to the
metabased implementation if a site is compromised then it would be trivial for the attacker to modify the CSP.