davideandClaude Sonnet 5
d60da11603
Caddy adds none of these on its own. Add HSTS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy and a CSP scoped to default-src 'self' plus the one external asset (Google Fonts). script-src/style-src need 'unsafe-inline' because both SPAs rely on inline onclick handlers and style="" attributes throughout — removing those is a separate, larger refactor. Validated with `caddy validate` and a live container curl check. Adds a static regression test asserting the header directives stay present in the Caddyfile, since nothing else in the Python suite exercises it. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
36 lines
1.0 KiB
Python
36 lines
1.0 KiB
Python
"""B-43: the Caddyfile must keep sending baseline security headers. Caddy adds
|
|
none of these on its own, and the JWT lives in localStorage, so a regression
|
|
here silently reopens an XSS/clickjacking exposure with no test ever failing
|
|
in the Python suite (the Caddyfile isn't imported/exercised by anything else)."""
|
|
|
|
from pathlib import Path
|
|
|
|
CADDYFILE = (Path(__file__).parent.parent.parent / "Caddyfile").read_text()
|
|
|
|
|
|
def test_header_block_present():
|
|
assert "header {" in CADDYFILE
|
|
|
|
|
|
def test_hsts_is_set():
|
|
assert "Strict-Transport-Security" in CADDYFILE
|
|
assert "max-age=" in CADDYFILE
|
|
|
|
|
|
def test_nosniff_is_set():
|
|
assert 'X-Content-Type-Options "nosniff"' in CADDYFILE
|
|
|
|
|
|
def test_frame_ancestors_are_blocked():
|
|
assert 'X-Frame-Options "DENY"' in CADDYFILE
|
|
assert "frame-ancestors 'none'" in CADDYFILE
|
|
|
|
|
|
def test_referrer_policy_is_set():
|
|
assert "Referrer-Policy" in CADDYFILE
|
|
|
|
|
|
def test_csp_default_src_is_self():
|
|
assert "Content-Security-Policy" in CADDYFILE
|
|
assert "default-src 'self'" in CADDYFILE
|