openvibers/openvibe.chat Commits

openvibe.party: the CSP lets the navbar's Messages count reach Chat (#393)

OP OpenVibers committed 6 days ago · 45aac43a99 · 2 files, +6 −1

On openvibe.party the shared navbar and the Dock call https://openvibe.chat/api/dm/*; the page's connect-src only
named 'self', so the count was refused (seen in the production proof).

Changes

ddiff --git a/server/web/layout.js b/server/web/layout.js
iindex cc06001..e25aeae 100644
---- a/server/web/layout.js
++++ b/server/web/layout.js
@@@ -87,7 +87,9 @@ function contentSecurityPolicy(nonce, wsOrigin = 'wss://openvibe.chat') {
          "img-src 'self' data: blob: https:",
          "media-src 'self' blob: https:",
          "font-src 'self' data:",
--        `connect-src 'self' ${wsOrigin} https://openvibe.network wss://openvibe.network https://openvibe.events wss://openvibe.events https://cloudflareinsights.com`,
++        // https://openvibe.chat: on Chat's other host (openvibe.party) the shared navbar's Messages count and the Dock
++        // still call Chat's DM API there (openvibe.party is on the credentialed CORS list, server/app.js).
++        `connect-src 'self' ${wsOrigin} https://openvibe.chat https://openvibe.network wss://openvibe.network https://openvibe.events wss://openvibe.events https://cloudflareinsights.com`,
          // A workspace room's shared screen: a screen share page from OpenVibe.Bot (rooms.screen_url).
          "frame-src 'self' https://openvibe.bot",
          "frame-ancestors 'self'",
ddiff --git a/test/party-media.test.js b/test/party-media.test.js
iindex f32133a..d7e1dd8 100644
---- a/test/party-media.test.js
++++ b/test/party-media.test.js
@@@ -199,6 +199,9 @@ t('openvibe.party: the start form, sign-in, and /new', async () => {
      assert.strictEqual(data.party.clock.paused, true);
      assert.strictEqual(data.party.lease.holder.subject, ann.subject_id);
      assert.ok(!shell.text.includes(madeKey), 'the link\'s secret is not echoed into the page');
++    // The navbar's Messages count calls Chat's DM API from this host: the page's CSP lets it.
++    const csp = String(shell.headers['content-security-policy'] || '');
++    assert.match(csp, /connect-src[^;]*https:\/\/openvibe\.chat(\s|;|$)/, 'connect-src names https://openvibe.chat');
      // The page loads Opus's page and Shared's player and clock.
      for (const file of ['/web/party.js', '/web/party.css', '/shared/ov-sync.js', '/shared/player.js', '/shared/player.css']) {
          assert.ok(shell.text.includes(file), `${file} is on the page`);