Merge pull request #196 from wavyboy-build/fix/csp-security-headers

Add CSP and security response headers

Author: N-thnI

README.md

@@ -856,7 +856,7 @@ Set all NEXT_PUBLIC_* vars in Vercel (or your hosting provider)
 
 Enable HTTPS — Freighter requires a secure context (https://)
 
-Add CSP headers allowing Stellar Horizon and Soroban RPC origins
+[x] Add CSP headers allowing Stellar Horizon and Soroban RPC origins — configured in next.config.mjs (headers()), connect-src derived from NEXT_PUBLIC_HORIZON_URL / NEXT_PUBLIC_SOROBAN_RPC_URL
 
 Configure GitHub webhook secret and validate X-Hub-Signature-256 in the relayer
 

__tests__/security-headers.test.js

@@ -0,0 +1,40 @@
+/**
+ * @jest-environment node
+ */
+const { getSecurityHeaders } = require('../security-headers');
+
+describe('security headers', () => {
+  const originalHorizon = process.env.NEXT_PUBLIC_HORIZON_URL;
+  const originalSoroban = process.env.NEXT_PUBLIC_SOROBAN_RPC_URL;
+
+  afterEach(() => {
+    process.env.NEXT_PUBLIC_HORIZON_URL = originalHorizon;
+    process.env.NEXT_PUBLIC_SOROBAN_RPC_URL = originalSoroban;
+  });
+
+  it('applies CSP and hardening headers to every route by default', () => {
+    delete process.env.NEXT_PUBLIC_HORIZON_URL;
+    delete process.env.NEXT_PUBLIC_SOROBAN_RPC_URL;
+
+    const byKey = Object.fromEntries(getSecurityHeaders().map((h) => [h.key, h.value]));
+
+    expect(byKey['Content-Security-Policy']).toContain("default-src 'self'");
+    expect(byKey['Content-Security-Policy']).toContain('connect-src');
+    expect(byKey['Content-Security-Policy']).toContain('https://horizon-testnet.stellar.org');
+    expect(byKey['Content-Security-Policy']).toContain('https://soroban-testnet.stellar.org');
+    expect(byKey['Content-Security-Policy']).toContain("frame-ancestors 'none'");
+    expect(byKey['X-Content-Type-Options']).toBe('nosniff');
+    expect(byKey['X-Frame-Options']).toBe('DENY');
+    expect(byKey['Referrer-Policy']).toBe('strict-origin-when-cross-origin');
+  });
+
+  it('derives connect-src from NEXT_PUBLIC_HORIZON_URL / NEXT_PUBLIC_SOROBAN_RPC_URL for self-hosted deployments', () => {
+    process.env.NEXT_PUBLIC_HORIZON_URL = 'https://horizon.example.com';
+    process.env.NEXT_PUBLIC_SOROBAN_RPC_URL = 'https://soroban.example.com';
+
+    const csp = getSecurityHeaders().find((h) => h.key === 'Content-Security-Policy').value;
+
+    expect(csp).toContain('https://horizon.example.com');
+    expect(csp).toContain('https://soroban.example.com');
+  });
+});

next.config.mjs

@@ -1,4 +1,15 @@
+import { getSecurityHeaders } from './security-headers.js';
+
 /** @type {import('next').NextConfig} */
-const nextConfig = {};
+const nextConfig = {
+  async headers() {
+    return [
+      {
+        source: '/:path*',
+        headers: getSecurityHeaders(),
+      },
+    ];
+  },
+};
 
 export default nextConfig;

security-headers.js

@@ -0,0 +1,32 @@
+const DEFAULT_HORIZON_URL = 'https://horizon-testnet.stellar.org';
+const DEFAULT_SOROBAN_RPC_URL = 'https://soroban-testnet.stellar.org';
+
+function getSecurityHeaders() {
+  const connectSrcOrigins = Array.from(
+    new Set(
+      [
+        "'self'",
+        process.env.NEXT_PUBLIC_HORIZON_URL || DEFAULT_HORIZON_URL,
+        process.env.NEXT_PUBLIC_SOROBAN_RPC_URL || DEFAULT_SOROBAN_RPC_URL,
+      ].filter(Boolean)
+    )
+  );
+
+  const contentSecurityPolicy = [
+    "default-src 'self'",
+    "script-src 'self' 'unsafe-inline'",
+    "style-src 'self' 'unsafe-inline'",
+    "img-src 'self' data:",
+    `connect-src ${connectSrcOrigins.join(' ')}`,
+    "frame-ancestors 'none'",
+  ].join('; ');
+
+  return [
+    { key: 'Content-Security-Policy', value: contentSecurityPolicy },
+    { key: 'X-Content-Type-Options', value: 'nosniff' },
+    { key: 'X-Frame-Options', value: 'DENY' },
+    { key: 'Referrer-Policy', value: 'strict-origin-when-cross-origin' },
+  ];
+}
+
+module.exports = { getSecurityHeaders };