syntax

try a couple other policies
more goog
2026-05-18 15:20:38 -05:00 · 2026-05-12 10:20:10 -05:00 · 2026-05-12 10:00:17 -05:00 · 2026-05-11 22:16:04 -05:00 · 2026-05-11 21:52:19 -05:00 · 2026-05-11 21:19:37 -05:00
3 changed files with 49 additions and 8 deletions
@@ -46,7 +46,7 @@
        "gulp.spritesmith": "^6.13.0",
        "habitica-markdown": "^4.1.0",
        "heapdump": "^0.3.15",
-        "helmet": "^4.6.0",
+        "helmet": "^8.1.0",
        "in-app-purchase": "^1.11.3",
        "js2xmlparser": "^5.0.0",
        "jsonwebtoken": "^9.0.2",
@@ -12798,12 +12798,11 @@
      }
    },
    "node_modules/helmet": {
-      "version": "4.6.0",
-      "resolved": "https://registry.npmjs.org/helmet/-/helmet-4.6.0.tgz",
-      "integrity": "sha512-HVqALKZlR95ROkrnesdhbbZJFi/rIVSoNq6f3jA/9u6MIbTsPh3xZwihjeI5+DO/2sOV6HMHooXcEOuwskHpTg==",
-      "license": "MIT",
+      "version": "8.1.0",
+      "resolved": "https://registry.npmjs.org/helmet/-/helmet-8.1.0.tgz",
+      "integrity": "sha512-jOiHyAZsmnr8LqoPGmCjYAaiuWwjAPLgY8ZX2XrmHawt99/u1y6RgrZMTeoPfpUbV96HOalYgz1qzkRbw54Pmg==",
      "engines": {
-        "node": ">=10.0.0"
+        "node": ">=18.0.0"
      }
    },
    "node_modules/hex2dec": {
@@ -41,7 +41,7 @@
    "gulp.spritesmith": "^6.13.0",
    "habitica-markdown": "^4.1.0",
    "heapdump": "^0.3.15",
-    "helmet": "^4.6.0",
+    "helmet": "^8.1.0",
    "in-app-purchase": "^1.11.3",
    "js2xmlparser": "^5.0.0",
    "jsonwebtoken": "^9.0.2",
@@ -68,7 +68,49 @@ export default function attachMiddlewares (app, server) {
  // See https://helmetjs.github.io/ for the list of headers enabled by default
  app.use(helmet({
    // New middlewares added by default in Helmet 4 are disabled
-    contentSecurityPolicy: false, // @TODO implement
+    contentSecurityPolicy: {
+      directives: {
+        defaultSrc: [
+          'habitica.com',
+          '*.habitica.com',
+          '*.amazon.com',
+          '*.amazonaws.com',
+          '*.google.com',
+          '*.googleapis.com',
+          '*.googleusercontent.com',
+          '*.loggly.com',
+          '*.payments-amazon.com',
+          '*.stripe.com',
+          '*.stripe.network',
+        ],
+        imgSrc: [
+          '*',
+          'data:',
+        ],
+        scriptSrc: [
+          'habitica.com',
+          '*.habitica.com',
+          '*.amazon.com',
+          '*.amazonaws.com',
+          '*.google.com',
+          '*.googleapis.com',
+          '*.googleusercontent.com',
+          '*.loggly.com',
+          '*.payments-amazon.com',
+          '*.stripe.com',
+          '*.stripe.network',
+        ],
+        upgradeInsecureRequests: IS_PROD ? [] : null,
+        frameAncestors: [
+          '*.google.com',
+          '*.googleapis.com',
+          '*.googleusercontent.com',
+        ],
+        sandbox: [
+          'allow-popups',
+        ],
+      },
+    },
    expectCt: false,
    permittedCrossDomainPolicies: false,
    referrerPolicy: false,
Author	SHA1	Message	Date
Kalista Payne	63d348b9b0	syntax	2026-05-12 10:20:10 -05:00
Kalista Payne	f049642ed9	try a couple other policies	2026-05-12 10:00:17 -05:00
Kalista Payne	d61b83f2ba	more goog	2026-05-11 22:16:04 -05:00
Kalista Payne	c747f6bb89	or inline?	2026-05-11 21:52:19 -05:00
Kalista Payne	5a37aae8d5	fix(csp):quotes	2026-05-11 21:19:37 -05:00
Kalista Payne	11752c8a86	test(csp): does Hello use unsafe eval?	2026-05-11 21:15:52 -05:00
Kalista Payne	d6b47a08a2	test(csp): googlecom?	2026-05-11 20:56:51 -05:00
Kalista Payne	1e4c5f8e38	test(csp): re-enable	2026-05-11 16:10:03 -05:00
Kalista Payne	57ae6be0e0	Revert "fix(auth): downgrade helmet" This reverts commit `3489b88752`.	2026-05-11 16:00:21 -05:00