security: enforce nonce based content policy

2026-09-13 16:38:47 +07:00
parent 1305cccfa5
commit 86ed3a966a
8 changed files with 68 additions and 11 deletions
@@ -23,3 +23,20 @@ test("production bootstrap supports submission and moderation", async ({ page, r
  expect(response.ok()).toBeTruthy();
  expect(await response.text()).toContain(player);
 });
+
+test("SSR pages use a per-response CSP nonce for JSON-LD", async ({ page, request }) => {
+  for (const path of ["/", "/report", "/admin/"]) {
+    const response = await page.goto(path);
+    const policy = response?.headers()["content-security-policy"] ?? "";
+    expect(policy).toContain("script-src 'self' 'nonce-");
+    expect(policy).not.toContain("'unsafe-inline'");
+    expect(policy).toContain("style-src-attr 'none'");
+    const nonce = await page.locator('script[type="application/ld+json"]').evaluate((node: HTMLScriptElement) => node.nonce);
+    expect(nonce).toMatch(/^[a-f0-9]{32}$/);
+    expect(policy).toContain(`'nonce-${nonce}'`);
+  }
+
+  const image = await request.get("/og-rf4spotter.png");
+  expect(image.ok()).toBeTruthy();
+  expect(image.headers()["content-type"]).toContain("image/png");
+});