Linus Rath 6ff94d439e fix: pin Lite pages to their own inline scripts and guard the Stalwart bundle ...

The static export's header policy has to allow inline scripts (the
hydration scripts differ per page and one header cannot list them all),
so any injected inline script ran. The Stalwart bundle had no policy at
all: Stalwart sends no security headers for an Application, and nothing
stopped another site from framing it.

- Postbuild gives every page of the static target a `<meta>` CSP that
  allows exactly the page's own inline scripts; enforced together with
  the host's header, it takes away `'unsafe-inline'`. `verify` fails a
  page whose inline scripts are not all pinned.
- The Stalwart entry document carries a `<meta>` CSP (no plugins, eval,
  foreign scripts or moved `<base>`; its shells are rewritten at runtime,
  so hashes are not possible there) and refuses to run inside a frame
  of another origin.
- The nginx and Caddy examples send the same CSP as `_headers`.

2026-09-26 17:27:00 +02:00

..

lite

fix: pin Lite pages to their own inline scripts and guard the Stalwart bundle

2026-09-26 17:27:00 +02:00