fabi/PiCloud
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(audit-2026-06-11/H-A1+A2+A3+M07-06+07+08+09): Caddy security-header layer

Browse Source 
Adds defense-in-depth HTTP headers to the dev and prod Caddyfiles. CSP,
X-Frame-Options, Permissions-Policy, and Cache-Control: no-store apply
to the dashboard SPA (/admin/*) and admin API (/api/v1/admin/*). nosniff
and Referrer-Policy apply to every response (a sane default). HSTS is
unconditional in prod.

User-route responses (the catch-all `handle`) deliberately get NO CSP —
user scripts own their own response headers by design.

The CSP / X-Frame-Options / Cache-Control / Permissions-Policy headers
use the `?` operator ("set only if not already present") so application
responses with their own restrictive policy — notably the audit C-2
file-download handler, which sends a sandboxed CSP — win over Caddy's
defaults.

This downgrades H-A4 (dashboard token in localStorage) from acute to
defense-in-depth: with this CSP and no inline JS in the dashboard,
XSS-based token exfiltration is no longer a one-step exploit.

Validated with `caddy validate` (docker caddy:2-alpine) for both files;
also `caddy fmt --overwrite`'d.

Audit ref: security_audit/07_http_cors_csrf_xss.md (H07-03/04/05 +
M07-06/07/08/09).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
MechaCat02
2026-06-11 20:27:47 +02:00
parent fde4796479
commit 9067225945
2 changed files with 62 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

31
caddy/Caddyfile
View File

@@ -14,7 +14,14 @@
#
# When v2 of the API ships, add `handle /api/v2/admin/* { ... }` etc.
# alongside the v1 handles, before the catch-all `/api/*` 404.
{
#
# Audit 2026-06-11 (H-A1/2/3, M07-06/07/08/09): defense-in-depth headers.
# CSP / X-Frame-Options / Permissions-Policy / no-store land on the
# dashboard SPA and admin API; nosniff + Referrer-Policy land everywhere.
# User-route responses (catch-all `handle`) deliberately get NO CSP —
# user scripts own their own response headers by design.
# `?` operator = "default if missing" so a downstream response (e.g. the
# file-download endpoint with its own restrictive CSP) wins.
{
auto_https off
admin off
@@ -25,6 +32,12 @@
}
:80 {
# Baseline headers applied to every response.
header {
X-Content-Type-Options "nosniff"
Referrer-Policy "no-referrer"
}
handle /healthz {
reverse_proxy picloud:8080
}
@@ -33,6 +46,12 @@
}
handle /api/v1/admin/* {
header {
?Content-Security-Policy "default-src 'none'; frame-ancestors 'none'; base-uri 'none'"
?X-Frame-Options "DENY"
?Cache-Control "no-store"
?Permissions-Policy "geolocation=(), camera=(), microphone=(), payment=(), usb=(), accelerometer=(), gyroscope=()"
}
reverse_proxy picloud:8080
}
handle /api/v1/execute/* {
@@ -50,10 +69,20 @@
# (root); we don't strip the prefix because SvelteKit was built with
# paths.base = '/admin' so the bundle's URLs already include it.
handle /admin/* {
header {
?Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self'; frame-ancestors 'none'; base-uri 'none'; form-action 'self'"
?X-Frame-Options "DENY"
?Cache-Control "no-store"
?Permissions-Policy "geolocation=(), camera=(), microphone=(), payment=(), usb=(), accelerometer=(), gyroscope=()"
}
reverse_proxy dashboard:80
}
handle /admin {
# Bare /admin (no trailing slash) — let SvelteKit's SPA handle it.
header {
?Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self'; frame-ancestors 'none'; base-uri 'none'; form-action 'self'"
?X-Frame-Options "DENY"
}
reverse_proxy dashboard:80
}