From 767d7ba039f644f4b3f370b7b722c772094664dd Mon Sep 17 00:00:00 2001 From: Sumit Mayani Date: Tue, 21 Apr 2026 11:00:29 +0530 Subject: [PATCH] fix: add form-action and frame-ancestors to CSP header in redirects default-src does not cover form-action or frame-ancestors directives per CSP spec, so omitting them allows unrestricted behavior for those vectors. Closes #187 Assisted-by AI: Claude (Anthropic) --- index.js | 2 +- test/test.js | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/index.js b/index.js index 1bee4637..a21c7d66 100644 --- a/index.js +++ b/index.js @@ -200,7 +200,7 @@ function createRedirectDirectoryListener () { res.statusCode = 301 res.setHeader('Content-Type', 'text/html; charset=UTF-8') res.setHeader('Content-Length', Buffer.byteLength(doc)) - res.setHeader('Content-Security-Policy', "default-src 'none'") + res.setHeader('Content-Security-Policy', "default-src 'none'; form-action 'none'; frame-ancestors 'none'") res.setHeader('X-Content-Type-Options', 'nosniff') res.setHeader('Location', loc) res.end(doc) diff --git a/test/test.js b/test/test.js index 9933eed1..ea7a1b99 100644 --- a/test/test.js +++ b/test/test.js @@ -510,7 +510,7 @@ describe('serveStatic()', function () { it('should respond with default Content-Security-Policy', function (done) { request(server) .get('/users') - .expect('Content-Security-Policy', "default-src 'none'") + .expect('Content-Security-Policy', "default-src 'none'; form-action 'none'; frame-ancestors 'none'") .expect(301, done) })