Skip to content

fix(security): Harden Content-Security-Policy header — add base-uri, object-src, Supabase connect-src#2159

Open
gowthamrdyy wants to merge 1 commit into
Priyanshu-byte-coder:mainfrom
gowthamrdyy:fix/add-content-security-policy-header
Open

fix(security): Harden Content-Security-Policy header — add base-uri, object-src, Supabase connect-src#2159
gowthamrdyy wants to merge 1 commit into
Priyanshu-byte-coder:mainfrom
gowthamrdyy:fix/add-content-security-policy-header

Conversation

@gowthamrdyy
Copy link
Copy Markdown
Contributor

@gowthamrdyy gowthamrdyy commented Jun 7, 2026

Summary

Closes #2148

This PR hardens the existing Content-Security-Policy (CSP) header in next.config.mjs by closing several attack vectors that the current policy left open.

Changes

Directive Before After Why
base-uri (missing) 'none' Prevents <base> tag injection — an attacker-controlled <base href> can redirect all relative URLs (scripts, links) to a malicious domain
object-src (missing) 'none' Disables legacy Flash/Java plugin execution, a well-known XSS vector
upgrade-insecure-requests (missing) ✅ present Instructs browsers to upgrade HTTP sub-resource requests to HTTPS automatically, preventing mixed-content downgrade
connect-src api.github.com, groq.com + *.supabase.co, wss://*.supabase.co, *.upstash.io Supabase realtime WebSocket and REST calls were blocked in strict CSP environments; Upstash Redis health-check calls similarly
img-src data: + blob: Canvas-generated image exports (e.g., ExportButton) use blob: object URLs
worker-src (missing) blob: Required for next-pwa service worker registration
Format Single long string Array joined with '; ' Dramatically improves readability and diff-ability of future CSP changes

Testing

  • ✅ No TypeScript errors (pnpm run type-check)
  • ✅ Lint clean (pnpm run lint)
  • ✅ Manually verified header is served in dev mode

GSSoc'26

🙋 Contributing on behalf of GSSoc'26. This is a level3 + type:security contribution.

@gowthamrdyy
fix(security): harden Content-Security-Policy header
d5cfcfe 
- Add base-uri 'none' to block <base> tag injection attacks
- Add object-src 'none' to disable Flash/plugin XSS vectors
- Add upgrade-insecure-requests for automatic HTTP→HTTPS sub-resource upgrade
- Expand connect-src to include Supabase (*.supabase.co, wss://*.supabase.co)
  and Upstash Redis (*.upstash.io) so authenticated API calls are not blocked
- Add worker-src blob: for next-pwa service worker compatibility
- Add blob: to img-src for canvas-generated image exports
- Restructure as an array joined with '; ' for improved readability

Closes Priyanshu-byte-coder#2148
Copilot AI review requested due to automatic review settings June 7, 2026 13:41
@vercel
Copy link
Copy Markdown

vercel Bot commented Jun 7, 2026

@gowthamrdyy is attempting to deploy a commit to the PRIYANSHU DOSHI's projects Team on Vercel.

A member of the Team first needs to authorize it.

@github-actions github-actions Bot added gssoc26 GSSoC 2026 contribution type:bug GSSoC type bonus: bug fix type:feature GSSoC type bonus: new feature type:security GSSoC type bonus: security (+20 pts) labels Jun 7, 2026
@github-actions
Copy link
Copy Markdown

github-actions Bot commented Jun 7, 2026

GSSoC Label Checklist 🏷️

@Priyanshu-byte-coder — please apply the appropriate labels before merging:

Difficulty (pick one):

  • level:beginner — 20 pts
  • level:intermediate — 35 pts
  • level:advanced — 55 pts
  • level:critical — 80 pts

Quality (optional):

  • quality:clean — ×1.2 multiplier
  • quality:exceptional — ×1.5 multiplier

Validation (required to score):

  • gssoc:approved — counts for points
  • gssoc:invalid / gssoc:spam / gssoc:ai-slop — does not score

Type labels (type:*) are auto-detected from files and title. Review and adjust if needed.
Points formula: (difficulty × quality_multiplier) + type_bonus

Copilot AI reviewed Jun 7, 2026
View reviewed changes
Copy link
Copy Markdown

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Updates the app’s Content Security Policy (CSP) configuration in next.config.mjs to be more explicit, add protections against common injection vectors, and allow required external connections (Supabase/Upstash).

Changes:

  • Refactors CSP header from a single string into a directive array joined by ; for readability/maintainability.
  • Adds additional CSP directives (base-uri, object-src, upgrade-insecure-requests, worker-src) and expands img-src/connect-src allowlists.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread next.config.mjs
Comment on lines +175 to +187
value: [
"default-src 'self'",
"script-src 'self' 'unsafe-eval' 'unsafe-inline'",
"style-src 'self' 'unsafe-inline' https://fonts.googleapis.com",
"font-src 'self' https://fonts.gstatic.com",
"img-src 'self' data: blob: https://avatars.githubusercontent.com https://github.githubassets.com",
"connect-src 'self' https://api.github.com https://groq.com https://api.groq.com https://*.supabase.co wss://*.supabase.co https://*.upstash.io",
"frame-ancestors 'none'",
"base-uri 'none'",
"object-src 'none'",
"upgrade-insecure-requests",
"worker-src blob:",
].join("; "),
Comment thread next.config.mjs
"style-src 'self' 'unsafe-inline' https://fonts.googleapis.com",
"font-src 'self' https://fonts.gstatic.com",
"img-src 'self' data: blob: https://avatars.githubusercontent.com https://github.githubassets.com",
"connect-src 'self' https://api.github.com https://groq.com https://api.groq.com https://*.supabase.co wss://*.supabase.co https://*.upstash.io",
Comment thread next.config.mjs
"frame-ancestors 'none'",
"base-uri 'none'",
"object-src 'none'",
"upgrade-insecure-requests",
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot Copilot left review comments

@Priyanshu-byte-coder Priyanshu-byte-coder Awaiting requested review from Priyanshu-byte-coder Priyanshu-byte-coder is a code owner

Assignees

@gowthamrdyy gowthamrdyy

Labels

gssoc26 GSSoC 2026 contribution type:bug GSSoC type bonus: bug fix type:feature GSSoC type bonus: new feature type:security GSSoC type bonus: security (+20 pts)

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

fix(security): Add Content-Security-Policy (CSP) header to prevent XSS attacks

2 participants

@gowthamrdyy