feat: harden frontend crate with security headers, asset validation, and gzip compression (#228)

* feat: add default security and privacy HTTP headers

Implement 8 security/privacy headers in create_default_headers():
- X-Content-Type-Options: nosniff
- X-Frame-Options: DENY
- Referrer-Policy: no-referrer
- X-XSS-Protection: 0 (disabled, rely on CSP instead)
- Strict-Transport-Security: max-age=31536000; includeSubDomains
- Permissions-Policy: deny camera, mic, geolocation, etc.
- Cross-Origin-Opener-Policy: same-origin
- Cross-Origin-Resource-Policy: same-origin

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* feat: add asset validation with file type allowlist, size limits, and path checks

- Add DEFAULT_ALLOWED_EXTENSIONS allowlist (22 web frontend extensions)
- Add 2MB default file size limit (DEFAULT_MAX_FILE_SIZE)
- Validate paths: reject .., //, and invalid URL characters
- Detect duplicate asset paths
- Add FrontendConfig for customization (extra extensions, custom size limit)
- Add setup_frontend_with_config() and asset_router_configs_with_config()
- asset_router_configs() now returns Result to surface validation errors

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* feat: add gzip compression for compressible frontend assets

- Add flate2 dependency for gzip compression
- Compress text-based assets (HTML, JS, CSS, JSON, SVG, XML, TXT, source maps)
  at init time and serve both identity and gzip variants
- AssetConfig for compressible files now includes both Identity and Gzip encodings
- IC asset router automatically negotiates encoding via Accept-Encoding header

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* test: add security header and gzip compression assertions to acceptance suite

- Verify all 8 security/privacy headers on frontend fallback response
- Verify gzip compression: request with Accept-Encoding returns gzip magic bytes
- Verify content-encoding: gzip header in compressed response

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* docs: update changelogs and README for frontend crate improvements

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix: use same-origin-allow-popups for COOP header to support II popups

Cross-Origin-Opener-Policy: same-origin blocks communication between
the dapp window and the Internet Identity popup (different canister
origins). Change to same-origin-allow-popups which still protects
against being opened by other origins but allows the dapp to open
II authentication popups that can communicate back.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

Author: Web3NL

Cargo.toml

@@ -33,3 +33,4 @@ serde_json = "1.0.149"
 sha2 = "0.10.9"
 num-traits = "0.2.19"
 clap = { version = "4", features = ["derive"] }
+flate2 = "1.1"

packages-rs/canister-dapp-test/CHANGELOG.md

@@ -4,6 +4,8 @@
 
 ### Added
 
+- Security header validation: all 8 security/privacy headers verified on frontend fallback responses
+- Gzip compression test: verifies Accept-Encoding negotiation returns compressed responses with correct headers
 - CLI binary: `canister-dapp-test <wasm-path>` runs the full acceptance suite against any dapp WASM.
 - HTTP response header validation: Content-Type for HTML/JS/CSS, Content-Security-Policy for dashboard HTML.
 - SPA fallback test: unknown paths serve index.html with 200 (client-side routing).

packages-rs/canister-dapp-test/src/lib.rs

@@ -369,6 +369,56 @@ pub fn run_acceptance_suite(wasm_bytes: &[u8], wasm_label: &str) {
     );
     assert_header_contains(&fallback_resp, "content-type", "text/html");
 
+    // ─── Security/privacy headers on frontend responses ─────────────────
+    // The frontend crate adds 8 security headers to every asset response.
+    assert_header_contains(&fallback_resp, "x-content-type-options", "nosniff");
+    assert_header_contains(&fallback_resp, "x-frame-options", "deny");
+    assert_header_contains(&fallback_resp, "referrer-policy", "no-referrer");
+    assert_header_contains(&fallback_resp, "x-xss-protection", "0");
+    assert_header_contains(
+        &fallback_resp,
+        "strict-transport-security",
+        "max-age=31536000",
+    );
+    assert_header_contains(&fallback_resp, "permissions-policy", "accelerometer=()");
+    assert_header_contains(
+        &fallback_resp,
+        "cross-origin-opener-policy",
+        "same-origin-allow-popups",
+    );
+    assert_header_contains(
+        &fallback_resp,
+        "cross-origin-resource-policy",
+        "same-origin",
+    );
+    println!("Frontend security headers OK (8/8 verified on fallback response)");
+
+    // ─── Gzip compression ───────────────────────────────────────────────
+    // Request with Accept-Encoding: gzip should return compressed content.
+    let (gzip_resp,) = query_candid::<_, (HttpResponse,)>(
+        &pic,
+        canister_id,
+        "http_request",
+        (HttpRequest::get("/this-path-does-not-exist")
+            .with_headers(vec![("Accept-Encoding".into(), "gzip".into())])
+            .build(),),
+    )
+    .expect("http_request with gzip encoding failed");
+    assert_eq!(
+        gzip_resp.status_code(),
+        200,
+        "Gzip fallback should return 200"
+    );
+    let body = gzip_resp.body();
+    assert!(
+        body.len() >= 2 && body[0] == 0x1f && body[1] == 0x8b,
+        "Response body should be gzip-compressed (expected magic bytes 0x1f 0x8b, got 0x{:02x} 0x{:02x})",
+        body.first().unwrap_or(&0),
+        body.get(1).unwrap_or(&0),
+    );
+    assert_header_contains(&gzip_resp, "content-encoding", "gzip");
+    println!("Gzip compression OK (verified on fallback response)");
+
     // ─── manage_alternative_origins ──────────────────────────────────────
 
     // Verify the initial origins JSON is valid and doesn't contain our test origins.

packages-rs/my-canister-frontend/CHANGELOG.md

@@ -2,6 +2,24 @@
 
 ## [Unreleased]
 
+### Added
+
+- 8 default security/privacy HTTP headers on all asset responses: X-Content-Type-Options, X-Frame-Options, Referrer-Policy, X-XSS-Protection, Strict-Transport-Security, Permissions-Policy, Cross-Origin-Opener-Policy, Cross-Origin-Resource-Policy
+- Asset validation: file type allowlist, 2 MB size limit, duplicate path detection, path traversal and malformed URL rejection
+- Gzip compression for text-based assets (HTML, JS, CSS, JSON, SVG, XML, TXT, source maps)
+- `FrontendConfig` struct for customization (extra allowed extensions, custom size limit)
+- `setup_frontend_with_config()` for configurable frontend initialization
+- `asset_router_configs_with_config()` for configurable asset processing
+
+### Changed
+
+- `asset_router_configs()` now returns `Result` to surface validation errors (breaking)
+- Compressible assets are served with both Identity and Gzip encodings
+
+### Dependencies
+
+- Added `flate2` for gzip compression
+
 ## [0.2.1] - 2025-09-11
 
 ### Changed

packages-rs/my-canister-frontend/Cargo.toml

@@ -21,6 +21,7 @@ ic-http-certification.workspace = true
 ic-cdk.workspace = true
 include_dir.workspace = true
 mime_guess.workspace = true
+flate2.workspace = true
 
 [package.metadata.release]
 pre-release-replacements = [

packages-rs/my-canister-frontend/README.md

@@ -37,9 +37,34 @@ fn http_request(req: HttpRequest) -> HttpResponse {
 - Automatic MIME type detection using `mime_guess`
 - `index.html` auto-configured as fallback for `/`
 - Certification using [`ic-asset-certification`](https://docs.rs/ic-asset-certification)
+- **Security headers**: 8 default security/privacy headers on all responses (HSTS, X-Frame-Options, Referrer-Policy, etc.)
+- **Asset validation**: File type allowlist, 2 MB size limit, path traversal protection, duplicate detection
+- **Gzip compression**: Automatic gzip for text-based assets (HTML, JS, CSS, JSON, SVG)
+- **Configurable**: Use `FrontendConfig` to allow additional file types or adjust size limits
 - Exposes `with_asset_router` and `with_asset_router_mut` for access to the asset router, see example below.
 - Exposes `asset_router_configs` if you want to implement your own asset router, see [this example](https://github.com/Web3NL/my-canister-dapp/blob/e8fdc0ac81f7bdc702418c05130ace3f9f5399fb/examples/my-hello-world/src/backend/src/lib.rs).
 
+## Configuration
+
+To allow additional file types or customize settings:
+
+```rust,ignore
+use ic_cdk::init;
+use include_dir::{include_dir, Dir};
+use my_canister_frontend::{setup_frontend_with_config, FrontendConfig};
+
+static ASSETS: Dir = include_dir!("$CARGO_MANIFEST_DIR/../dapp-frontend/dist");
+
+#[init]
+fn init() {
+    let config = FrontendConfig {
+        extra_allowed_extensions: vec!["webmanifest".to_string()],
+        ..Default::default()
+    };
+    setup_frontend_with_config(&ASSETS, &config).expect("Failed to setup frontend");
+}
+```
+
 ## Usage with [`my_canister_dashboard`](https://crates.io/crates/my-canister-dashboard)
 
 ```rust,ignore