From 8dc850f845c3a578f8f45c3dde9ac080d0474d79 Mon Sep 17 00:00:00 2001 From: Ark0N Date: Mon, 8 Jun 2026 01:29:26 +0200 Subject: [PATCH] fix(csp): drop now-unused gesture CDN connect-src entries (self-hosted MediaPipe) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit MediaPipe's wasm runtime + model are served same-origin from /gesture/, so the gesture CSP no longer needs https://cdn.jsdelivr.net / https://storage.googleapis .com in connect-src ('self' covers same-origin). Kept 'wasm-unsafe-eval' (script-src, WASM compile) and worker-src 'self' blob: (MediaPipe blob workers). Codeman's base jsdelivr entries (script/style/font-src) are unchanged — those aren't gesture's. Co-Authored-By: Claude Opus 4.8 (1M context) --- src/web/middleware/auth.ts | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/src/web/middleware/auth.ts b/src/web/middleware/auth.ts index 74416491..6b372ca5 100644 --- a/src/web/middleware/auth.ts +++ b/src/web/middleware/auth.ts @@ -155,14 +155,14 @@ export function registerAuthMiddleware(app: FastifyInstance, https: boolean): Au */ export function registerSecurityHeaders(app: FastifyInstance, https: boolean): void { // Gesture-control overlay (opt-in via CODEMAN_GESTURE=1) runs MediaPipe, which - // needs WebAssembly eval and must fetch its wasm/model from the pinned CDNs. - // Computed once; OFF by default so the production CSP is byte-for-byte unchanged. + // needs WebAssembly eval (script-src) and blob workers (worker-src). Its wasm + // runtime + model are self-hosted under /gesture/ (same-origin, covered by + // 'self'), so no CDN connect-src entries are needed. OFF by default so the + // production CSP is byte-for-byte unchanged. const gesture = process.env.CODEMAN_GESTURE === '1'; const scriptSrc = "script-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net" + (gesture ? " 'wasm-unsafe-eval'" : ''); - const connectSrc = - "connect-src 'self' wss://api.deepgram.com" + - (gesture ? ' https://cdn.jsdelivr.net https://storage.googleapis.com' : ''); + const connectSrc = "connect-src 'self' wss://api.deepgram.com"; const workerSrc = gesture ? "; worker-src 'self' blob:" : ''; const csp = `default-src 'self'; ${scriptSrc}; style-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net; ` +