openvibers/openvibe.live Commits

No speculation rules on Live: a CSP report per page view, and prefetches nothing used (#604)

OP OpenVibers committed 10 days ago · fcb45bb40f · 2 files, +7 −0

The shared navbar injects inline speculation rules unless told not to. Live's report-only policy lists script hashes,
and Chrome ignores 'inline-speculation-rules' beside hashes, so every page view sent a POST /api/csp-report (the
browser smoke check flagged it on /broadcast). Live is a single-page app: its router answers same-site links, so the
pages the rules prefetched were never used.

Changes

ddiff --git a/public/js/ov-navbar-live.js b/public/js/ov-navbar-live.js
iindex d70ae9f6..e72a4828 100644
---- a/public/js/ov-navbar-live.js
++++ b/public/js/ov-navbar-live.js
@@@ -86,6 +86,10 @@
              messages: { onOpen: () => { if (window.messengerWidget && window.messengerWidget.toggle) window.messengerWidget.toggle(); else location.href = 'https://openvibe.chat/messages'; }, href: 'https://openvibe.chat/messages' },
              // Same-origin links are routes of this single-page app.
              onNavigate: (href, e) => (typeof handleLinkClick === 'function' ? handleLinkClick(e, href) : true),
++            // No speculation rules: the router answers same-site links, so a prefetched page was never used, and the
++            // injected rules broke the hash-based report-only CSP on every page view (11-03: a /api/csp-report POST
++            // each load; Chrome ignores 'inline-speculation-rules' beside hashes).
++            speculate: false,
              onLogout: () => call('logout'),
          };
      }
ddiff --git a/test/navbar-menu-live.test.js b/test/navbar-menu-live.test.js
iindex 1174cbbf..83cf2e09 100644
---- a/test/navbar-menu-live.test.js
++++ b/test/navbar-menu-live.test.js
@@@ -27,4 +27,7 @@ assert.deepStrictEqual(sections, ["{ id: 'live', label: 'Live', items: ["], 'one
  });
  assert.ok(!/\bafter:/.test(menu), 'no rows after the network\'s');
  
++// The router answers same-site links, so the navbar's speculation rules (which broke the report-only CSP) are off.
++assert.match(src.slice(src.indexOf('function config(user)')), /speculate: false,/, 'no speculation rules on Live');
++
  console.log('navbar menu live: all checks passed');