FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

Add per-response CSP nonces by niemyjski · Pull Request #2363 · exceptionless/Exceptionless · GitHub

/ Exceptionless Public

Add per-response CSP nonces - #2363

Draft
niemyjski wants to merge 14 commits into
mainfrom
feature/strict-dynamic-csp
ConversationCommits (14)ChecksFiles changed
Draft

Add per-response CSP nonces#2363
niemyjski wants to merge 14 commits into
mainfrom
feature/strict-dynamic-csp

Conversation

niemyjski commented Jul 10, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

Summary

  • issue a fresh 32-byte CSP nonce for every successful HTML response and enable strict-dynamic without unsafe-inline or unsafe-eval for scripts
  • stamp script elements through the existing ASP.NET response pipeline, with no custom SPA file provider or application-level file reads
  • prevent nonce-bearing HTML from being cached while preserving the existing CSP allowlists and /api exclusion

Verification

  • dotnet build tests/Exceptionless.Tests/Exceptionless.Tests.csproj --no-restore --disable-build-servers — 0 warnings, 0 errors
  • dotnet test tests/Exceptionless.Tests/Exceptionless.Tests.csproj --no-restore --no-build -- --filter-class Exceptionless.Tests.Api.CspNonceTests — 3 passed
  • Svelte npm run build
  • Angular npm run build
  • local AppHost Scalar verification — all 3 scripts matched the CSP header nonce, the next response used a different nonce, and the browser reported no errors
  • local production-host response verification — strict-dynamic and no-store were present

Breaking changes

None. API routes continue to omit the frontend CSP header.

niemyjski commented Jul 26, 2026

Copy link
Copy Markdown
Member Author

Current-feedback closeout (2026-07-26):

  • Re-fetched the live head (0bddf5a) and current main (dc940dd); the PR is clean, mergeable, and zero commits behind.
  • Audited every feedback surface: 0 GraphQL review threads, 0 inline comments, 0 submitted reviews, and 0 human issue comments. The coverage-bot comment is current informational output and needs no code action.
  • Re-reviewed the complete effective diff under the thermo-nuclear maintainability bar. No additional change is justified: CSP ownership remains isolated from host wiring, Program.cs shrinks, the three runtime policies are guarded by one parity contract, no source file crosses 1,000 lines, and dev-only LiveReload transformation complexity stays confined to its middleware.
  • Local proof: SpaIndexHtmlMiddlewareTests 17/17; Svelte CSP tests 12/12; Angular CSP/renderer tests 7/7; Exceptionless.Web build succeeded with 0 warnings and 0 errors; Svelte and Angular production builds succeeded.
  • Live CI is fully green, including API, client, E2E, Docker, version, and CLA.

No follow-up commit was necessary, and draft/admin state was left unchanged.

niemyjski self-assigned this Jul 30, 2026
niemyjski force-pushed the feature/strict-dynamic-csp branch from 0bddf5a to 7ee01eb Compare July 30, 2026 18:18
niemyjski changed the title Secure SPA script loading with strict CSP Add per-response CSP nonces Jul 30, 2026
niemyjski force-pushed the feature/strict-dynamic-csp branch from 7ee01eb to b7eab28 Compare July 30, 2026 18:30
niemyjski force-pushed the feature/strict-dynamic-csp branch from b7eab28 to 3cb0aa3 Compare July 30, 2026 19:39

niemyjski commented Aug 12, 2026

Copy link
Copy Markdown
Member Author

Fixed the failing CSP fallback integration coverage in 9f10cf351 by making the integration host exercise the production response-level nonce middleware and SPA fallback delegate.

Verification after push:

  • Local test project build: 0 warnings, 0 errors
  • SpaIndexHtmlMiddlewareTests: 17/17 passed
  • CspNonceTests: 3/3 passed
  • GitHub CI: client, full API coverage suite, E2E, version, and Docker build all passed

Re-audited the review surfaces: there are no submitted reviews or review threads to resolve.

github-actions Bot commented Aug 19, 2026

Copy link
Copy Markdown

Package Line Rate Branch Rate Complexity Health
Exceptionless.Insulation 37% 35% 286 ❌
Exceptionless.Core 75% 67% 10184 ✔
Exceptionless.Web 85% 69% 7942 ✔
Exceptionless.AppHost 38% 41% 147 ❌
Summary 78% (25333 / 32332) 67% (11845 / 17590) 18559 ✔

This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Show hidden characters
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

niemyjski

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

Back | FazBrowse Home | New Git URL