fix: CCP-3643 lock down csp

[WalterMoar]

Description

The Content Security Policy for the frontend Caddyfile is not only overly permissive but it also includes things like openstreetmap. It’s probable that the CSP was copied from CHEFS and we cannot ignore security best practices and the OWASP ZAP Scan findings.

Work through the OWASP ZAP Scan results and with a timebox of one day fix as many of the issues as possible.

Acceptance Criteria

• As many ZAP Scan items as possible are fixed within the timebox
• No new ZAP Scan items are added to the report
• The app continues to function as expected

Type of change

• Bug fix (non-breaking change which fixes an issue)

How Has This Been Tested?

Manual testing plus running the ZAP Scan against the PR.

Checklist

• I have read the CONTRIBUTING doc
• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• My changes generate no new warnings
• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes
• Any dependent changes have already been accepted and merged

---

Thanks for the PR!

Deployments, as required, will be available below:

• Frontend
• Backend
• OpenAPI

Please create PRs in draft mode. Mark as ready to enable:

• Analysis Workflow

After merge, new images are deployed in:

• Merge Workflow

[BrandonSharratt]

Wondering why this and X-XSS-Protection were removed as I believe they pertain to iframe security

[WalterMoar]

Thanks for the feedback! Good question about X-Frame-Options. CSP replaced it with frame-ancestors: 'self', but I supposed it could be left in for IE11? And other legacy browsers?

X-XSS-Protection is discouraged, though, and again replaced with the CSP. AFAIK current browsers have stopped using it. I suppose that again we could leave it in for legacy browsers, but if anything it should be explicitly disabled (0) to prevent buggy legacy filters from being used.

[WalterMoar]

@BrandonSharratt - restored the X-Frame-Options header, thanks! I think that since X-XSS-Protection is deprecated it's best to remove it.

[sonarqubecloud]

Quality Gate passed for 'tenant-management-system_frontend'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud