diff options
Diffstat (limited to 'packages/meshbay-client/src')
| -rw-r--r-- | packages/meshbay-client/src/main.js | 18 |
1 files changed, 16 insertions, 2 deletions
diff --git a/packages/meshbay-client/src/main.js b/packages/meshbay-client/src/main.js index 3926c01..e3735e6 100644 --- a/packages/meshbay-client/src/main.js +++ b/packages/meshbay-client/src/main.js @@ -58,15 +58,29 @@ const SCHEME = 'app'; // The hub is reachable under connect-src, for its API and its signaling socket. // It is deliberately absent from script-src: nothing it returns is executed, // which is the whole reason this application exists (T3). +// +// The one exception is reCAPTCHA, used to gate sign-up (and password reset) the +// same way it gates them in the browser. Its script comes from www.google.com, +// its challenge is a www.google.com iframe, and its assets sit on +// www.gstatic.com. These two hosts — and only these two — are allowed under +// `script-src`, `frame-src` and `img-src` for that purpose. It is a real, if +// small, dent in "no third-party code runs here": Google's reCAPTCHA script +// executes in the renderer. It is accepted deliberately so a native sign-up is +// gated like a web one without asking the user to do anything extra, and it is +// the *same* dependency the hub-served SPA already carries. If sign-up ever +// moves to a proof-of-work challenge, delete RECAPTCHA_SRC and the three +// directives that spread it, and the widget in auth-page.js with them. +const RECAPTCHA_SRC = 'https://www.google.com https://www.gstatic.com'; const CSP = [ "default-src 'none'", - "script-src 'self' 'wasm-unsafe-eval'", + `script-src 'self' 'wasm-unsafe-eval' ${RECAPTCHA_SRC}`, "style-src 'self' 'unsafe-inline'", - "img-src 'self' data: blob:", + `img-src 'self' data: blob: ${RECAPTCHA_SRC}`, "media-src 'self' blob:", "font-src 'self'", "connect-src 'self' https: wss:", "worker-src 'self'", + `frame-src ${RECAPTCHA_SRC}`, "frame-ancestors 'none'", "base-uri 'none'", "form-action 'none'", |