Repository navigation

Add strict nonce CSP for the modern Svelte frontend - #2363

Merged

niemyjski merged 36 commits into

mainfrom

feature/strict-dynamic-csp

Oct 15, 2026

Merged

Add strict nonce CSP for the modern Svelte frontend#2363
niemyjski merged 36 commits into
mainfrom
feature/strict-dynamic-csp

Commits on Oct 15, 2026
- Simplify CSP nonce injection
  niemyjski
  committed
  f4ca990
- Handle wildcard CSP navigation requests
  niemyjski
  committed
  dea0935
- Secure SPA scripts with strict CSP
  niemyjski
  committed
  171de3e
- Scope Intercom CSP sources to US
  niemyjski
  committed
  1564623
- fix: harden strict CSP response handling
  niemyjski
  committed
  a91c32d
- Harden and synchronize CSP policies
  niemyjski
  committed
  ee816cd
- Apply Svelte formatting
  niemyjski
  committed
  76f1a18
- Verify development CSP policy parity
  niemyjski
  committed
  682275d
- Update CSP test fallback to MapFallbackToFile
  niemyjski
  committed
  52b8950
- Fix CSP fallback integration coverage
  niemyjski
  committed
  1dcf5eb
- Harden CSP response handling and align production coverage
  niemyjski
  committed
  71522cf
- Verify Intercom messenger CSP connection sources
  niemyjski
  committed
  1173503
- Scope strict CSP to the modern Svelte frontend
  niemyjski
  committed
  55bbb8f
- Preserve empty same-origin CSP configuration
  niemyjski
  committed
  d8944bf
- Limit modern frontend CSP to used vendor capabilities
  niemyjski
  committed
  d70c5a2
- Remove unused telemetry sources and blob worker permission
  niemyjski
  committed
  260f181
- Drop unused Checkout and Connect image allowance
  niemyjski
  committed
  572a9b6
- Authorize only trusted frontend scripts and reject partial HTML
  niemyjski
  committed
  024658c
- Simplify CSP for the single static Svelte frontend
  niemyjski
  committed
  b68613b
- Align SPA hosting assertions with the simplified CSP
  niemyjski
  committed
  45a1929
- Drop unused blob media permission
  niemyjski
  committed
  d9c9c76
- Clarify Scalar nonce setup and align CSP tests with conventions
  niemyjski
  committed
  13a03ce
- Restrict backend CSP connections and explain policy sources
  niemyjski
  committed
  abb6d25
- Clarify the payment frame policy comment
  niemyjski
  committed
  17f48d9
- Default CSP to deny unspecified resources
  niemyjski
  committed
  0426e7c
- Tighten unused frontend CSP sources
  niemyjski
  committed
  7fb4866
- Preserve SPA CSP hashes and honor runtime SSL configuration
  niemyjski
  committed
  c68d1a0
- Use HTTPS for Gravatar on HTTP-only hosts
  niemyjski
  committed
  0a17464
- Remove startup script tests and redundant CSP references
  niemyjski
  committed
  8da5002
- Use app options and consolidate CSP response tests
  niemyjski
  committed
  218dbc9
- Reuse application factory for CSP response checks
  niemyjski
  committed
  101dd97
- Isolate published CSP fixture from development asset manifests
  niemyjski
  committed
  6f8845d
- Restore versioned runtime URLs with matching CSP hashes
  niemyjski
  committed
  2daec1f
- Allow configured browser telemetry in strict CSP
  niemyjski
  committed
  1e2b5d8
- Align CSP policy formatting with review feedback
  niemyjski
  committed
  fdd40fb
- Restore Intercom uploads and embedded help articles
  niemyjski
  committed
  2893d94

Commits

Commits on Oct 15, 2026