Skip to content

Commit

Permalink
fix(nosecone)!: Remove upgradeInsecureRequests default value (#2401)
Browse files Browse the repository at this point in the history 
This removes the `upgradeInsecureRequests` default value from Nosecone because running in development mode often won't have https enabled.

We'll instead recommend in our docs that users add this with a production env check.
  • Loading branch information
@blaine-arcjet
blaine-arcjet authored Dec 3, 2024
1 parent 58286b7 commit 093dc53
Show file tree
Hide file tree
Showing 2 changed files with 5 additions and 9 deletions.
1 change: 0 additions & 1 deletion nosecone/index.ts
View file
Original file line number Diff line number Diff line change
Expand Up @@ -429,7 +429,6 @@ const directives = {
scriptSrc: ["'self'"],
styleSrc: ["'self'"],
workerSrc: ["'self'"],
upgradeInsecureRequests: true,
} as const;

export const defaults = {
Expand Down
13 changes: 5 additions & 8 deletions nosecone/test/nosecone.test.ts
View file
Original file line number Diff line number Diff line change
Expand Up @@ -33,15 +33,15 @@ describe("nosecone", () => {
const policy = createContentSecurityPolicy();
assert.deepStrictEqual(policy, [
"content-security-policy",
"base-uri 'none'; child-src 'none'; connect-src 'self'; default-src 'self'; font-src 'self'; form-action 'self'; frame-ancestors 'none'; frame-src 'none'; img-src 'self' blob: data:; manifest-src 'self'; media-src 'self'; object-src 'none'; script-src 'self'; style-src 'self'; worker-src 'self'; upgrade-insecure-requests;",
"base-uri 'none'; child-src 'none'; connect-src 'self'; default-src 'self'; font-src 'self'; form-action 'self'; frame-ancestors 'none'; frame-src 'none'; img-src 'self' blob: data:; manifest-src 'self'; media-src 'self'; object-src 'none'; script-src 'self'; style-src 'self'; worker-src 'self';",
]);
});

it("uses default directive if none provided", () => {
const policy = createContentSecurityPolicy({});
assert.deepStrictEqual(policy, [
"content-security-policy",
"base-uri 'none'; child-src 'none'; connect-src 'self'; default-src 'self'; font-src 'self'; form-action 'self'; frame-ancestors 'none'; frame-src 'none'; img-src 'self' blob: data:; manifest-src 'self'; media-src 'self'; object-src 'none'; script-src 'self'; style-src 'self'; worker-src 'self'; upgrade-insecure-requests;",
"base-uri 'none'; child-src 'none'; connect-src 'self'; default-src 'self'; font-src 'self'; form-action 'self'; frame-ancestors 'none'; frame-src 'none'; img-src 'self' blob: data:; manifest-src 'self'; media-src 'self'; object-src 'none'; script-src 'self'; style-src 'self'; worker-src 'self';",
]);
});

Expand Down Expand Up @@ -552,7 +552,7 @@ describe("nosecone", () => {
assert.deepStrictEqual(Array.from(headers.entries()), [
[
"content-security-policy",
"base-uri 'none'; child-src 'none'; connect-src 'self'; default-src 'self'; font-src 'self'; form-action 'self'; frame-ancestors 'none'; frame-src 'none'; img-src 'self' blob: data:; manifest-src 'self'; media-src 'self'; object-src 'none'; script-src 'self'; style-src 'self'; worker-src 'self'; upgrade-insecure-requests;",
"base-uri 'none'; child-src 'none'; connect-src 'self'; default-src 'self'; font-src 'self'; form-action 'self'; frame-ancestors 'none'; frame-src 'none'; img-src 'self' blob: data:; manifest-src 'self'; media-src 'self'; object-src 'none'; script-src 'self'; style-src 'self'; worker-src 'self';",
],
["cross-origin-embedder-policy", "require-corp"],
["cross-origin-opener-policy", "same-origin"],
Expand All @@ -574,7 +574,7 @@ describe("nosecone", () => {
assert.deepStrictEqual(Array.from(headers.entries()), [
[
"content-security-policy",
"base-uri 'none'; child-src 'none'; connect-src 'self'; default-src 'self'; font-src 'self'; form-action 'self'; frame-ancestors 'none'; frame-src 'none'; img-src 'self' blob: data:; manifest-src 'self'; media-src 'self'; object-src 'none'; script-src 'self'; style-src 'self'; worker-src 'self'; upgrade-insecure-requests;",
"base-uri 'none'; child-src 'none'; connect-src 'self'; default-src 'self'; font-src 'self'; form-action 'self'; frame-ancestors 'none'; frame-src 'none'; img-src 'self' blob: data:; manifest-src 'self'; media-src 'self'; object-src 'none'; script-src 'self'; style-src 'self'; worker-src 'self';",
],
["cross-origin-embedder-policy", "require-corp"],
["cross-origin-opener-policy", "same-origin"],
Expand Down Expand Up @@ -629,7 +629,7 @@ describe("nosecone", () => {
assert.deepStrictEqual(Array.from(headers.entries()), [
[
"content-security-policy",
"base-uri 'none'; child-src 'none'; connect-src 'self'; default-src 'self'; font-src 'self'; form-action 'self'; frame-ancestors 'none'; frame-src 'none'; img-src 'self' blob: data:; manifest-src 'self'; media-src 'self'; object-src 'none'; script-src 'self'; style-src 'self'; worker-src 'self'; upgrade-insecure-requests;",
"base-uri 'none'; child-src 'none'; connect-src 'self'; default-src 'self'; font-src 'self'; form-action 'self'; frame-ancestors 'none'; frame-src 'none'; img-src 'self' blob: data:; manifest-src 'self'; media-src 'self'; object-src 'none'; script-src 'self'; style-src 'self'; worker-src 'self';",
],
["cross-origin-embedder-policy", "require-corp"],
["cross-origin-opener-policy", "same-origin"],
Expand Down Expand Up @@ -703,7 +703,6 @@ describe("nosecone", () => {
objectSrc: ["'none'"],
scriptSrc: ["'self'", "https://vercel.live"],
styleSrc: ["'self'", "https://vercel.live", "'unsafe-inline'"],
upgradeInsecureRequests: true,
workerSrc: ["'self'"],
},
},
Expand Down Expand Up @@ -922,7 +921,6 @@ describe("nosecone", () => {
objectSrc: ["'none'"],
scriptSrc: ["'self'", "https://vercel.live"],
styleSrc: ["'self'", "https://vercel.live", "'unsafe-inline'"],
upgradeInsecureRequests: true,
workerSrc: ["'self'"],
},
},
Expand Down Expand Up @@ -965,7 +963,6 @@ describe("nosecone", () => {
objectSrc: ["'none'"],
scriptSrc: ["'self'", "https://vercel.live"],
styleSrc: ["'self'", "https://vercel.live", "'unsafe-inline'"],
upgradeInsecureRequests: true,
workerSrc: ["'self'"],
},
},
Expand Down

0 comments on commit 093dc53

Please sign in to comment.