Implement strict Content Security Policy using react-helmet-async #79
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
piyushsinghgaur1
changed the title
AryanshSourcefuse
suggested changes
May 16, 2025
feat(security): implement CSP via react-helmet-async in React frontend
… configuration Add CSP directives and client config to environment files Updates example environment files to include Content Security Policy (CSP) directives with secure defaults and client configuration keys. Introduces logic to dynamically expand environment variables within CSP directives, validates critical directives, and ensures secure defaults where missing. Enhances security and configurability. Relates to: feat(config)
|
|
No longer required, as we've implemented a generic CSP package for both React and Angular boilerplates. See: https://github.com/sourcefuse/arc-spa-csp |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description:
This PR enhances the security of the React frontend by implementing a robust Content Security Policy (CSP) using
react-helmet-async.Key Changes:
react-helmet-asyncto manage CSP via React componentsdefault-src 'self') to block untrusted sources<meta http-equiv="Content-Security-Policy">fromindex.htmlWhy This Matters:
A strong CSP helps protect against XSS, clickjacking, and code injection attacks by limiting which sources are allowed to load content in the app.