Description
There's no evidence of a configured Content Security Policy in next.config.ts or middleware. For an application handling wallet connections and financial transactions, CSP headers are a meaningful defense-in-depth measure against XSS, especially given the app renders user/third-party-influenced content (invoice descriptions, dispute evidence text).
Requirements and context
- Add CSP headers via Next.js middleware or
next.config.ts headers configuration
- Scope allowed script/style/connect sources to what's actually needed (Freighter extension communication, Horizon, Supabase, Resend if client-side, font/analytics origins)
- Test thoroughly — an overly strict CSP can silently break wallet extension communication, which needs explicit verification
Suggested execution
git checkout -b feat/add-content-security-policy
- Add CSP headers configuration
- Test all wallet/API interactions still function correctly
- Document the policy and rationale in
docs/security-headers.md
Example commit message
feat: add Content Security Policy headers
Description
There's no evidence of a configured Content Security Policy in
next.config.tsor middleware. For an application handling wallet connections and financial transactions, CSP headers are a meaningful defense-in-depth measure against XSS, especially given the app renders user/third-party-influenced content (invoice descriptions, dispute evidence text).Requirements and context
next.config.tsheaders configurationSuggested execution
docs/security-headers.mdExample commit message
feat: add Content Security Policy headers