fix(CSP): more Amazon domains

fix(csp): more loggly allowance
fix(csp): data, inline, some refactoring
2025-12-13 20:57:24 +01:00 · 2025-12-12 17:27:50 -06:00 · 2025-12-12 17:18:08 -06:00 · 2025-12-12 17:12:00 -06:00 · 2025-12-12 17:05:44 -06:00 · 2025-12-12 16:56:24 -06:00
3 changed files with 35 additions and 7 deletions
--- a/package-lock.json
+++ b/package-lock.json
@@ -45,7 +45,7 @@
        "gulp-imagemin": "^7.1.0",
        "gulp.spritesmith": "^6.13.0",
        "habitica-markdown": "^3.0.0",
-        "helmet": "^4.6.0",
+        "helmet": "^8.1.0",
        "in-app-purchase": "^1.11.3",
        "js2xmlparser": "^5.0.0",
        "jsonwebtoken": "^9.0.2",
@@ -12450,11 +12450,11 @@
      }
    },
    "node_modules/helmet": {
-      "version": "4.6.0",
-      "resolved": "https://registry.npmjs.org/helmet/-/helmet-4.6.0.tgz",
-      "integrity": "sha512-HVqALKZlR95ROkrnesdhbbZJFi/rIVSoNq6f3jA/9u6MIbTsPh3xZwihjeI5+DO/2sOV6HMHooXcEOuwskHpTg==",
+      "version": "8.1.0",
+      "resolved": "https://registry.npmjs.org/helmet/-/helmet-8.1.0.tgz",
+      "integrity": "sha512-jOiHyAZsmnr8LqoPGmCjYAaiuWwjAPLgY8ZX2XrmHawt99/u1y6RgrZMTeoPfpUbV96HOalYgz1qzkRbw54Pmg==",
      "engines": {
-        "node": ">=10.0.0"
+        "node": ">=18.0.0"
      }
    },
    "node_modules/hex2dec": {
--- a/package.json
+++ b/package.json
@@ -40,7 +40,7 @@
    "gulp-imagemin": "^7.1.0",
    "gulp.spritesmith": "^6.13.0",
    "habitica-markdown": "^3.0.0",
-    "helmet": "^4.6.0",
+    "helmet": "^8.1.0",
    "in-app-purchase": "^1.11.3",
    "js2xmlparser": "^5.0.0",
    "jsonwebtoken": "^9.0.2",
--- a/website/server/middlewares/index.js
+++ b/website/server/middlewares/index.js
@@ -66,7 +66,35 @@ export default function attachMiddlewares (app, server) {
  // See https://helmetjs.github.io/ for the list of headers enabled by default
  app.use(helmet({
    // New middlewares added by default in Helmet 4 are disabled
-    contentSecurityPolicy: false, // @TODO implement
+    contentSecurityPolicy: {
+      directives: {
+        defaultSrc: [
+          '*.habitica.com',
+          '*.amazon.com',
+          '*.amazonaws.com',
+          '*.loggly.com',
+          '*.payments-amazon.com',
+          '*.stripe.com',
+          '*.stripe.network',
+        ],
+        imgSrc: [
+          '*',
+          'data:',
+        ],
+        scriptSrc: [
+          '\'unsafe-eval\'',
+          '\'unsafe-inline\'',
+          '*.habitica.com',
+          '*.amazon.com',
+          '*.amazonaws.com',
+          '*.loggly.com',
+          '*.payments-amazon.com',
+          '*.stripe.com',
+          '*.stripe.network',
+        ],
+        upgradeInsecureRequests: IS_PROD ? [] : null,
+      },
+    },
    expectCt: false,
    permittedCrossDomainPolicies: false,
    referrerPolicy: false,
Author	SHA1	Message	Date
Kalista Payne	cc6a35e61d	fix(CSP): more Amazon domains	2025-12-12 17:27:50 -06:00
Kalista Payne	985b86c29a	fix(csp): more loggly allowance	2025-12-12 17:18:08 -06:00
Kalista Payne	166bd31527	fix(csp): data, inline, some refactoring	2025-12-12 17:12:00 -06:00
Kalista Payne	1a0a6c1806	fix(CSP): override default script-src	2025-12-12 17:05:44 -06:00
Kalista Payne	023d9886c8	fix(CSP): unsafe-eval in default-src	2025-12-12 16:56:24 -06:00
Kalista Payne	f51f0a0c93	fix(CSP): move trusted list to default-src	2025-12-12 16:52:14 -06:00
Kalista Payne	83b2ba7688	fix(CSP): explicit habitica/aws in script-src	2025-12-12 16:38:05 -06:00
Kalista Payne	d5ca5172d5	fix(CSP): need escaped single quotes	2025-12-12 16:31:38 -06:00
Kalista Payne	c677a1ffef	fix(CSP): unsafe-eval	2025-12-12 16:27:46 -06:00
Kalista Payne	6ef35c3f72	fix(CSP): might need to skip entirely in dev but try no 'self'	2025-12-12 16:15:07 -06:00
Kalista Payne	5759fb37d8	fix(csp): permit AWS in default-src	2025-12-12 15:51:26 -06:00
Kalista Payne	9f238abf93	fix(csp): update helmet version to latest	2025-12-10 16:41:29 -06:00
Kalista Payne	9462e90f4f	feat(security): implement CSP	2025-12-10 16:41:29 -06:00