Comment on I built a self-hosted period tracker because I couldn't find one worth using
terraincognita@lemmy.world 2 days agoThanks for the suggestions, those are good points.
CSP is something I plan to tighten over time, but enabling a strict policy right now would require refactoring some inline JS patterns used in the templates. It’s definitely on the roadmap as part of security hardening.
Regarding CORS, the application currently runs as a same-origin server-rendered app rather than a cross-origin API, so CORS headers aren’t enabled by default. If external clients or integrations are added in the future, I’d likely introduce a restricted allowlist for specific API routes.
Pieisawesome@lemmy.dbzer0.com 2 days ago
Your releasing a health data app without doing security hardening?
So much for you saying you take security seriously
terraincognita@lemmy.world 2 days ago
No, we didn’t ship it without security hardening.
We already hardened the main sensitive parts:
sealed auth/recovery/reset/flash cookies no auth or recovery secrets in URLs or JSON POST + CSRF logout basic browser security headers CodeQL, gosec, Trivy, and SBOM in CI What’s still missing is a strict CSP. That’s not a one-line switch here because the current frontend still needs some refactoring first.
terraincognita@lemmy.world 1 day ago
CSP is released.
terraincognita@lemmy.world 2 days ago
Worth to say, that this is an ongoing development, this is not even version 1, v 0.3.1
napkin2020@sh.itjust.works 1 day ago
What a douchebag