security headers with prerendered routes

[FranckFreiburger]

Hello,
routes marked as prerender: true (in routeRules configuration entry) seems to emit no security headers.
Is it possible to enable them for prerendered routes ?
Thanks.

[vejja]

Hi @FranckFreiburger
You're right. It is by design but we might be able to change this.
Will have a look into it and let you know

[FranckFreiburger]

hi, any update ?

[FranckFreiburger]

Currently, prerendered routes have their Content-Security-Policy set through <meta http-equiv="Content-Security-Policy" content=...
This seems perfectly legitimate but seems to bother security-check websites like https://securityheaders.com/
Potentially I'd like to see all headers managed by nuxt-security as usual http headers.

[FranckFreiburger]

FYI, I just asked securityheaders.com why meta http-equiv is not taken into account, their response is:

We don't have any plans to inspect CSP sent via a meta tag, only a CSP sent as a response header.

A CSP delivered in a meta tag is limited in functionality, which is the main reason we don't consider it. Also, all of the other security features we analyse have to set by a response header, so it should usually be possible to set CSP the same way.

[vejja]

Hi

This is true. CSP can be sent either via header, or via meta tag. The security features are the same and all browsers support <meta> : see MDN
I do agree though that sending via headers is a bit better, as it is the only way to implement the reporting functionality.

The issue we are facing with Nuxt is that it is a hybrid framework so we need to support both SSR and SSG.

• If you run your application in SSR (default) mode, the pages are generated on the fly by the Nitro server, so this allows us to send CSP via headers
• If you build your application statically in SSG mode, the pages are delivered by your CDN. We don't have control over your CDN so we cannot modify their headers : this is why we deliver CSP via <meta>.

As far as I understand, you are in a hybrid situation : it sounds that you are delivering your application in SSR mode, but you have one specific page that you want to pre-render. So right now all of your application has CSP transmitted via headers, except for that specific page where headers are transmitted via <meta>.

However we are looking whether it is possible to detect that this specific page was pre-rendered and ask the Nitro server to add the CSP headers on top of the <meta> tag. It is not easy because pre-rendering prevents us from using the nonce approach so we need to fallback to sha hashes in that case, but it might not be impossible. It requires significant modifications of our core engine though.

In the meantime, I can suggest 3 possible mitigants for your use case:

1. Forget about the output of securityheaders.com. You are in fact CSP-compliant and their report is incomplete because they didn't check the <meta> tag.
2. Do not pre-render that page. If it is not performance-critical to pre-render that page, you can rely on the fact that you already have a full SSR server that can deliver CSP via headers.
3. Modify your headers manually with your CDN provider. Some hosting providers will allow you to write header rules. This requires more manual work, but you can extract the CSP from the <meta> tag manually and copy that value to configure the headers delivered by your CDN.

I'll let you know here whether we are able to support your use case natively. I think we should aim to do it if we can, so if possible we'll provide it.

[FranckFreiburger]

Thank you for your clear answer, in the meantime, I think the the best option for us is to forget about the output of securityheaders.com

[Baroshem]

Thanks so much @vejja for the great writeup! 🎉

[vejja]

Hi @FranckFreiburger @Baroshem
Just to let you know that I've been able to add this feature to the core engine of Nuxt Security
Will open a PR as soon as tests confirmed

[Baroshem]

Great, make sure to tag us so that we could review it :)

[vejja]

PR #441

[vejja]

Ready for review now
Should result in better scores with securityheaders.com hopefully

[FranckFreiburger]

Hi,
It seems that everything is ok in dev (nuxt dev) but when I try to build (nuxt build, nuxt preview) I have no CSP HTTP header and I still have <meta http-equiv="Content-Security-Policy" ...

(nuxt-security: 1.4.3)

[vejja]

Hi @FranckFreiburger
PR has not been merged yet, review still in progress
You can try the 2.0.0-beta.0 though, at your own risks 😳

[FranckFreiburger]

oh, sorry for that