Address domain and email security findings from report.#465
Open
mikewillems wants to merge 8 commits into
Open
Address domain and email security findings from report.#465mikewillems wants to merge 8 commits into
mikewillems wants to merge 8 commits into
Conversation
Document required SPF, DKIM, and DMARC records for preventing email spoofing. Cross-reference from dev.md to hosting.md.
Code writes to 'sendgridmail' but docs said 'sendgridemail'. Confirmed via firebase ext:export that the extension watches 'sendgridmail'.
Add X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy headers to all responses served by Firebase Hosting via firebase.json.
X-Frame-Options and X-Content-Type-Options as meta tags are ignored by browsers. Both are now set as HTTP response headers in firebase.json.
Contributor
There was a problem hiding this comment.
Pull request overview
This PR hardens the web client’s browser security posture (CSP + security response headers) and updates deployment documentation for SendGrid (including correct Firestore collection name and SPF/DKIM/DMARC setup guidance).
Changes:
- Adds security-related HTTP response headers for Firebase Hosting responses (
X-Frame-Options,X-Content-Type-Options,Referrer-Policy,Permissions-Policy). - Introduces a CSP
<meta http-equiv="Content-Security-Policy">and appliesnonce="__SCRIPT_NONCE__"to script tags in the web entrypoint. - Updates hosting/dev docs for SendGrid collection name and adds email authentication DNS record instructions.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 4 comments.
| File | Description |
|---|---|
firebase.json |
Adds default security headers for Firebase Hosting responses. |
client/web/index.html |
Adds CSP meta policy and script nonces to harden against XSS. |
docs/pages/hosting.md |
Fixes SendGrid collection name and documents SPF/DKIM/DMARC setup. |
docs/pages/dev.md |
Fixes SendGrid collection name and links to hosting guidance for DNS auth records. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| http-equiv="Content-Security-Policy" | ||
| content="default-src 'self'; | ||
| worker-src 'self' blob:; | ||
| script-src 'self' 'wasm-unsafe-eval' 'nonce-__SCRIPT_NONCE__' https://www.gstatic.com https://zencdn.net https://vjs.zencdn.net https://player.vimeo.com http://media.twiliocdn.com https://upload-widget.cloudinary.com https://cdn.jsdelivr.net; |
Comment on lines
+128
to
+131
| <script | ||
| nonce="__SCRIPT_NONCE__" | ||
| src="//media.twiliocdn.com/sdk/js/video/releases/2.17.1/twilio-video.min.js" | ||
| ></script> |
Comment on lines
+102
to
+105
| <script | ||
| nonce="__SCRIPT_NONCE__" | ||
| src="https://www.gstatic.com/firebasejs/8.6.1/firebase-app.js" | ||
| ></script> |
|
Visit the preview URL for this PR (updated for commit 736995f): https://gen-hls-bkc-7627--pr465-mw-sec-domain-and-em-oehek6dk.web.app (expires Fri, 26 Jun 2026 20:33:05 GMT) 🔥 via Firebase Hosting GitHub Action 🌎 Sign: eed668cca81618d491d024574a8f8a6003deaa8d |
katherineqian
changed the title
katherineqian
requested changes
Jun 12, 2026
katherineqian
left a comment
katherineqian
left a comment
Collaborator
There was a problem hiding this comment.
Thank you for addressing these findings!
The main outstanding issue I'm encountering is that the preview build on staging is failing to load the app -- looks like some of the security policies may be too strict and blocking critical functionality. See my console output.
|
|
||
| - Uses a Firestore extension. Emails definitions are written to the firestore collection sendgridemail. | ||
| - Configure the firestore extension "Trigger Email" firebase/firestore-send-email@0.1.9 with your sendgrid info | ||
| - Uses a Firestore extension. Email definitions are written to the Firestore collection `sendgridmail`. |
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What is in this PR?
This PR addresses issues identified in 2 analyses / audits of Frankly. Mostly, it hardens browser policies for functions to block against XSS attacks. These may need to be separately deployed with
firebase deploy --only hosting.Changes in the codebase
63c9539- Cherry-pick of @johnnycrich's CSP + nonce implementation 🙏🙏🙏 . AddsContent-Security-Policymeta tag with__SCRIPT_NONCE__placeholders toclient/web/index.html, plus nonce attributes on all script tags.bbb06f8- Fix docs typo:sendgridemail->sendgridmailindocs/pages/hosting.mdanddocs/pages/dev.md. Confirmed correct viafirebase ext:export.9632147- Add email authentication DNS setup instructions (SPF, DKIM, DMARC) todocs/pages/hosting.mdwith cross-reference fromdocs/pages/dev.md.63e8906- AddX-Frame-Options,X-Content-Type-Options,Referrer-Policy, andPermissions-Policyas HTTP response headers infirebase.jsonfor all Firebase Hosting responses.7a6fc64- RemoveX-Frame-OptionsandX-Content-Type-Optionsmeta tags fromclient/web/index.html(browsers ignore these as meta tags; now handled by HTTP headers infirebase.json).Changes outside the codebase
See internal audit review for out-of-codebase config instructions.
Testing this PR
Not public :P
PR Checklist
function-mapping.json.Additional information
AI tools used (if applicable):
NA