Repository navigation
Site: strict CSP with per-request nonce, HSTS, X-Frame-Options, noindex on pages.dev - #19
Merged
Merged
Conversation
…ex on pages.dev Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Deploying upright with
|
| Latest commit: |
8b5c00f
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://db9ef4d2.upright-2ev.pages.dev |
| Branch Preview URL: | https://claude-upright-security-head.upright-2ev.pages.dev |
4 of 6 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Requested by Boss
Before: upright.hellobasalt.dev sent only nosniff and a referrer policy. It had no Content-Security-Policy, HSTS or X-Frame-Options, and the upright-2ev.pages.dev preview host could be indexed.
After: every page sends a strict CSP with no 'unsafe-inline' for scripts, plus HSTS, X-Frame-Options: DENY and a Permissions-Policy. Each HTML response gets a fresh nonce, so Cloudflare's injected bot-check script can still run. Responses on *.pages.dev carry X-Robots-Tag: noindex, and the custom domain stays indexable.
How:
site/_headersholds the policy. The one inline script (adding the "js" class) is allowed by its sha256 hash.functions/_middleware.jsadds the per-request nonce on HTML responses, as on the hub (hellobasalt.dev PR #7), andsite/_routes.jsonkeeps the function off static files. Tested withwrangler pages dev: the nonce changes on every request, the console is clean on / and /mx-vertical, and the page renders at phone and desktop width.🤖 Generated with Claude Code