From 4b4fb7aaf8641391a24d0347519988440fb185b1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marc-Andr=C3=A9=20Bombeck?= Date: Wed, 27 May 2026 00:04:54 +0200 Subject: [PATCH] feat(security): emit COOP, CORP, and X-Permitted-Cross-Domain-Policies headers Three additions to the production header set in `src/proxy.ts`: - `Cross-Origin-Opener-Policy: same-origin` isolates the BrowsingContextGroup from cross-origin popups. Closes the `window.opener` reference channel for Spectre-class side-channel attacks. The OAuth flows (Withings, Codex) are top-level redirects rather than popups, so they aren't affected. - `Cross-Origin-Resource-Policy: same-origin` narrows the page's resources to same-origin loaders, complementing the existing `frame-ancestors 'none'` CSP rule for non-document subresources. - `X-Permitted-Cross-Domain-Policies: none` shuts the Flash / Adobe Reader `crossdomain.xml` channel that some scanners still flag. All three land in every response; production-only HSTS stays in its existing `!isDev` block. No CSP changes. Co-Authored-By: Claude Opus 4.7 (1M context) --- src/proxy.ts | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/src/proxy.ts b/src/proxy.ts index ee1d52d12..6a8311d27 100644 --- a/src/proxy.ts +++ b/src/proxy.ts @@ -233,6 +233,16 @@ export function proxy(request: NextRequest) { "Permissions-Policy", "camera=(), microphone=(), geolocation=()", ); + // COOP isolates this BrowsingContextGroup from cross-origin popups, + // closing the Spectre-class side-channel surface a stray + // `window.opener` reference would otherwise carry. CORP narrows the + // page's resources to same-origin loaders, complementing the + // `frame-ancestors 'none'` CSP rule for non-document subresources. + // The legacy `X-Permitted-Cross-Domain-Policies` line shuts the + // Flash/PDF crossdomain.xml channel that some scanners still flag. + response.headers.set("Cross-Origin-Opener-Policy", "same-origin"); + response.headers.set("Cross-Origin-Resource-Policy", "same-origin"); + response.headers.set("X-Permitted-Cross-Domain-Policies", "none"); // CSP — permissive in dev, strict in production. Third-party hosts in // `connect-src` are gated to the surfaces that actually need them so a