RomanNum3ral
/
Cybersecurity-Projects
mirror of https://github.com/CarterPerez-dev/Cybersecurity-Projects.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

fix(canary): CSP allows challenges.cloudflare.com for Turnstile 

Audit F10: script-src 'self' blocked the Turnstile bootstrap script
(https://challenges.cloudflare.com/turnstile/v0/api.js) and its widget
iframe. Added challenges.cloudflare.com to script-src, connect-src, and a
new frame-src directive so the widget can render under prod CSP.
This commit is contained in:
CarterPerez-dev 2026-05-17 19:07:41 -04:00
parent e78c33ae18
commit 4382ba5e17
1 changed files with 4 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
PROJECTS/beginner/canary-token-generator/backend/internal/middleware/headers.go
View File

@ -42,18 +42,19 @@ func SecurityHeaders(isProduction bool) func(http.Handler) http.Handler {
func buildCSP(isProduction bool) string { func buildCSP(isProduction bool) string {
directives := []string{ directives := []string{
"default-src 'self'", "default-src 'self'",
"script-src 'self'", "script-src 'self' https://challenges.cloudflare.com",
"style-src 'self' 'unsafe-inline'", "style-src 'self' 'unsafe-inline'",
"img-src 'self' data: https:", "img-src 'self' data: https:",
"font-src 'self'", "font-src 'self'",
"connect-src 'self'", "connect-src 'self' https://challenges.cloudflare.com",
"frame-src https://challenges.cloudflare.com",
"frame-ancestors 'none'", "frame-ancestors 'none'",
"base-uri 'self'", "base-uri 'self'",
"form-action 'self'", "form-action 'self'",
} }
if !isProduction { if !isProduction {
directives[1] = "script-src 'self' 'unsafe-inline' 'unsafe-eval'" directives[1] = "script-src 'self' 'unsafe-inline' 'unsafe-eval' https://challenges.cloudflare.com"
} }
return strings.Join(directives, "; ") return strings.Join(directives, "; ")