chore: send security headers with every response - #8
Merged
Merged
Conversation
flield.com served no security headers at all. Cloudflare reads a _headers file from the assets directory at deploy and applies it, so this adds the four that fit a static site with no forms and no third-party code: nosniff, a referrer policy, a permissions policy that turns off the device APIs the app never asks for, and a content security policy locked to the site's own origin. The policy keeps 'unsafe-inline' for scripts and styles, since every page carries its script inline and nothing exists to mint a nonce. It still stops any script from another host, re-basing, plugins, and forms posting elsewhere. Cloudflare Web Analytics is the one outside party the dashboard injects, and both of its hosts are allowed. Checked by serving the repo locally with these exact headers: no violation events, PNG and SVG export, the GIF encoder and its worker, the redrawn favicon, the theme toggle, and the explainers' live canvases all ran as before. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
flield | 54b6c2a | Commit Preview URL Branch Preview URL |
Sep 13 2026, 08:55 PM |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What does this change?
Adds a
_headersfile, which Cloudflare reads at deploy and applies to every response. flield.com currently sends no security headers. This adds:X-Content-Type-Options: nosniffReferrer-Policy: strict-origin-when-cross-originPermissions-Policyturning off camera, microphone, geolocation, payment, and USBContent-Security-Policylocked to the site's own origin, plus the two Cloudflare Web Analytics hosts the dashboard injectsThe CSP keeps
'unsafe-inline'for scripts and styles because every page carries its script inline and there is no server to mint a nonce. It still blocks scripts from any other host,<base>hijacking, plugins, and forms posting anywhere else.Not included on purpose:
frame-ancestorsorX-Frame-Options. Nothing says flield.com must never be embedded, so this leaves framing alone.Related issue
None. Came out of the site-wide audit that landed as d062ac9 and 509a42f.
How was this tested?
Served the repo locally through a small Python server that applies the headers from
_headersverbatim, then in Chrome: confirmed each header on the response, listened forsecuritypolicyviolationevents (none), exported PNG and SVG, ran a GIF export so gif.js and its worker loaded, confirmed the favicon still redraws from adata:URL, toggled the theme, and loaded the flow-fields explainer with its six live canvases drawn.The Workers Builds preview for this branch already serves the headers:
curl -Ion its/and/guide/shows all four, and/_headersitself returns 404, so Cloudflare consumed the file rather than publishing it.Checklist
generator.jsstill has no dependency on the UI, if touched (not touched)🤖 Generated with Claude Code