Repository navigation
Fix security issues: headers, replay protection, CSP, and permissions - #156
Merged
Busiii-adetiba merged 4 commits intoOct 20, 2026
Conversation
When init.headers is passed as an array (e.g., [["key", "value"]]), it must be normalized before reading from it. The previous code had duplicate variable definitions that would skip normalization for non-Headers instances. Fix: Consistently use new Headers(init.headers) to normalize all header formats before reading Idempotency-Key. This ensures array-form headers are properly converted to the Headers API before lookup.
The signature scheme includes a timestamp but no nonce, making requests vulnerable to replay attacks within the timestamp window. Replay protection must be enforced server-side using: 1. Timestamp window validation (e.g., ±5 minutes) 2. Idempotency-Key deduplication to track and reject replayed requests 3. Optional nonce requirement for higher security Update documentation to clearly specify these requirements and explain how they work together to prevent replays. Also document that nonces are compatible with the signing scheme if the server wants to add them in the future.
…e script The index.html had an inline <script> block applying theme and language preferences before first paint. This violates the CSP which sets script-src 'self', allowing only external scripts. Fix: Move the inline script into the external public/theme-init.js file, which is already being loaded. This maintains the same functionality (avoiding flash of unstyled/wrong-language content on first paint) while complying with the CSP. The script now runs from an external source and is allowed by script-src 'self'.
The nginx.conf sets Permissions-Policy to restrict camera, microphone, geolocation, and USB access: camera=(), microphone=(), geolocation=(), usb=(). Vercel deployments were missing this header, creating an inconsistency between the two deployment targets. Now both nginx and Vercel enforce the same security headers.
|
@deborahamoni0-prog is attempting to deploy a commit to the work Team on Vercel. A member of the Team first needs to authorize it. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fix four security issues identified in the SynapsVault frontend:
Idempotency-Key is read only from Headers or plain objects #30: Normalize headers before reading Idempotency-Key. Array-form headers were not being properly converted before lookup, causing the key to be missed.
Request signatures have a timestamp but no nonce #32: Document server-side replay protection requirements. The signature scheme uses timestamps but no nonce. Servers must enforce replay defense through timestamp windows and Idempotency-Key deduplication. Add guide on optional nonce support.
nginx.conf sets no Content-Security-Policy #35: Fix CSP violation with inline script. Move theme and language initialization logic from an inline <script> block in index.html to the external public/theme-init.js file, allowing it to pass script-src 'self' CSP.
vercel.json sets no security headers #36: Add Permissions-Policy header to Vercel deployments. Mirror nginx.conf's camera/microphone/geolocation/USB restrictions in vercel.json to ensure both deployment targets have consistent security headers.
Testing
Closes #30
Closes #32
Closes #35
Closes #36