Add CSP headers (#7083)

* reduce external links * add csp headers * ignore csp in cypress * avoid waiting for fontawesome in cypress * Revert "ignore csp in cypress" This reverts commit fe54552.
ohcnetwork · Jan 23, 2024 · 619cff7 · 619cff7
1 parent 8025200
commit 619cff7
Show file tree

Hide file tree

Showing 10 changed files with 81 additions and 225 deletions.
diff --git a/.env b/.env
@@ -8,3 +8,5 @@ REACT_PUBLIC_URL=https://care.coronasafe.in
 
 # Dev envs
 ESLINT_NO_DEV_ERRORS=true
+
+CARE_CDN_URL="https://egov-s3-facility-10bedicu.s3.amazonaws.com https://egov-s3-patient-data-10bedicu.s3.amazonaws.com http://localhost:4566"
diff --git a/cypress/support/commands.ts b/cypress/support/commands.ts
@@ -69,10 +69,8 @@ Cypress.Commands.add("loginByApi", (username, password) => {
 Cypress.Commands.add(
   "awaitUrl",
   (url: string, disableLoginVerification = false) => {
-    cy.intercept(/fontawesome/).as("fontawesome");
     cy.intercept(/currentuser/).as("currentuser");
     cy.visit(url);
-    cy.wait("@fontawesome");
     disableLoginVerification
       ? cy.wait("@currentuser")
       : cy.wait("@currentuser").its("response.statusCode").should("eq", 200);

diff --git a/index.html b/index.html
@@ -24,18 +24,12 @@
     <meta name="theme-color" content="#0e9f6e" />
     <link rel="shortcut icon" href="/favicon.ico" type="image/x-icon" />
     <link rel="apple-touch-icon" href="/images/icons/apple-touch-icon-180x180.png">
-    <link rel="preconnect" href="https://fonts.googleapis.com" />
-    <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
-    <link
-      href="https://fonts.googleapis.com/css2?family=Inter:wght@100;200;300;400;500;600;700;800;900&display=swap"
-      rel="stylesheet"
-    />
   </head>
 
   <body>
     <noscript>You need to enable JavaScript to run this app.</noscript>
     <div id="root">
-      <style>
+      <style nonce="7e14cf80">
         .App-logo {
           height: 10vmin;
           pointer-events: none;
@@ -53,8 +47,14 @@
           75% {opacity: 0.5;}
           100% {opacity: 0;}
         }
+        .temp-loading {
+          display: grid;
+          place-items: center;
+          height: 100vh;
+          text-align: center;
+        }
       </style>
-      <div style="display: grid;place-items: center;height: 100vh; text-align: center;">
+      <div class="temp-loading">
         <img 
         class="App-logo"
         src="https://cdn.coronasafe.network/light-logo.svg"
@@ -63,11 +63,7 @@
       </div>
     </div>
     <script type="module" src="/src/index.tsx"></script>
-    <script
-      src="https://kit.fontawesome.com/d69454c2e7.js"
-      crossorigin="anonymous"
-    ></script>
-    <script>
+    <script nonce="f51b9742">
       window.plausible =
         window.plausible ||
         function () {

diff --git a/netlify.toml b/netlify.toml
@@ -24,3 +24,12 @@ status = 200
     cache-control = "max-age=0, no-store"
     X-Frame-Options = "DENY"
     X-Content-Type-Options = "nosniff"
+    Content-Security-Policy = '''
+      default-src 'self';
+      script-src 'self' 'nonce-f51b9742' https://plausible.10bedicu.in;
+      style-src 'self' 'nonce-7e14cf80';
+      connect-src 'self' https://sentry.io https://plausible.10bedicu.in https://egov-s3-facility-10bedicu.s3.amazonaws.com https://egov-s3-patient-data-10bedicu.s3.amazonaws.com;
+      img-src 'self' blob: data: https://cdn.coronasafe.network https://egov-s3-facility-10bedicu.s3.amazonaws.com https://egov-s3-patient-data-10bedicu.s3.amazonaws.com;
+      media-src 'self' blob: data: https://cdn.coronasafe.network https://egov-s3-facility-10bedicu.s3.amazonaws.com https://egov-s3-patient-data-10bedicu.s3.amazonaws.com;
+      object-src 'self' blob: https://egov-s3-facility-10bedicu.s3.amazonaws.com https://egov-s3-patient-data-10bedicu.s3.amazonaws.com;
+      '''
Original file line number	Diff line number	Diff line change
Expand Up		@@ -8,3 +8,5 @@ REACT_PUBLIC_URL=https://care.coronasafe.in

		# Dev envs
		ESLINT_NO_DEV_ERRORS=true

		CARE_CDN_URL="https://egov-s3-facility-10bedicu.s3.amazonaws.com https://egov-s3-patient-data-10bedicu.s3.amazonaws.com http://localhost:4566"