bert.hausmans
940297f214
API middleware: - SecurityHeaders now sets Content-Security-Policy from config/security.php - Default API policy: "default-src 'none'; frame-ancestors 'none'" - Supports report-only mode via CSP_REPORT_ONLY env var - Policy value configurable via CSP_POLICY env var Nginx deployment configs (deploy/nginx/): - security-headers.conf: shared headers for all server blocks - csp-api.conf: restrictive JSON-only policy for api.crewli.app - csp-spa.conf: SPA policy for app/admin (self + unsafe-inline styles) - csp-portal.conf: portal policy matching SPA Development: - CSP meta tags added to all three index.html files - Includes 'unsafe-inline' + 'unsafe-eval' for Vite HMR/loader script - Each app allows its own ws:// port for HMR websocket Resolves security finding A13-9. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
37 lines
1.1 KiB
PHP
37 lines
1.1 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
return [
|
|
|
|
/*
|
|
|--------------------------------------------------------------------------
|
|
| Content Security Policy
|
|
|--------------------------------------------------------------------------
|
|
|
|
|
| CSP header value. Set to null to disable. Use report-only mode first
|
|
| to identify violations before enforcing.
|
|
|
|
|
| For the API: restrictive policy (no scripts, no styles needed).
|
|
| For SPAs: CSP is configured at the web server (Nginx) level because
|
|
| Vite-generated script hashes change per build.
|
|
|
|
|
*/
|
|
|
|
'csp' => env('CSP_POLICY', "default-src 'none'; frame-ancestors 'none'"),
|
|
|
|
/*
|
|
|--------------------------------------------------------------------------
|
|
| CSP Report Only
|
|
|--------------------------------------------------------------------------
|
|
|
|
|
| When true, sends Content-Security-Policy-Report-Only instead of
|
|
| Content-Security-Policy. Violations are logged but not blocked.
|
|
| Use this for initial rollout to catch false positives.
|
|
|
|
|
*/
|
|
|
|
'csp_report_only' => env('CSP_REPORT_ONLY', false),
|
|
|
|
];
|