BLOCKED: config: add anti-clickjacking headers #8

Open

vkobel wants to merge 1 commit from fix/clickjacking-headers into main

vkobel commented

2026-08-24 11:23:29 +00:00

(Migrated from codeberg.org)

Why

caution.co can currently be embedded by arbitrary sites because its Caddy responses do not set an anti-framing policy. The live web-server configuration also is not tracked alongside the site source.

Summary

Add a production Caddy configuration for caution.co and www.caution.co.
Deny framing with CSP frame-ancestors 'none' and X-Frame-Options: DENY.
Add nosniff and a strict-origin referrer policy while preserving the current HSTS value.
Document validation, installation, and reload commands.

Risk / security impact

Prevents the static marketing site from being embedded for UI-redress/clickjacking attempts.
Uses a narrowly scoped CSP directive, so existing scripts, styles, images, and other resources remain unaffected.
Does not change dashboard.caution.co, which already sends its own anti-framing headers.
Merging does not alter production until the tracked Caddy configuration is installed and Caddy is reloaded.

Test plan

make build — passes; Jekyll production image builds successfully.
docker run --rm -v "$PWD/Caddyfile:/etc/caddy/Caddyfile:ro" caddy:2 caddy validate --config /etc/caddy/Caddyfile — valid configuration.
Serve the generated _site with the Caddy config on local HTTP and issue a HEAD request — returns frame-ancestors 'none', X-Frame-Options: DENY, nosniff, the strict-origin referrer policy, and the existing HSTS value.
git diff --check — passes.

Production rollout

Back up and compare the current /etc/caddy/Caddyfile on caution.co with the tracked configuration.
Install the tracked configuration and run caddy validate --config /etc/caddy/Caddyfile.
Reload Caddy and verify both https://caution.co/ and https://www.caution.co/ with curl -sSI.

Rollback: restore the previous Caddyfile and reload Caddy.

## Why `caution.co` can currently be embedded by arbitrary sites because its Caddy responses do not set an anti-framing policy. The live web-server configuration also is not tracked alongside the site source. ## Summary - Add a production Caddy configuration for `caution.co` and `www.caution.co`. - Deny framing with CSP `frame-ancestors 'none'` and `X-Frame-Options: DENY`. - Add `nosniff` and a strict-origin referrer policy while preserving the current HSTS value. - Document validation, installation, and reload commands. ## Risk / security impact - Prevents the static marketing site from being embedded for UI-redress/clickjacking attempts. - Uses a narrowly scoped CSP directive, so existing scripts, styles, images, and other resources remain unaffected. - Does not change `dashboard.caution.co`, which already sends its own anti-framing headers. - Merging does not alter production until the tracked Caddy configuration is installed and Caddy is reloaded. ## Test plan - `make build` — passes; Jekyll production image builds successfully. - `docker run --rm -v "$PWD/Caddyfile:/etc/caddy/Caddyfile:ro" caddy:2 caddy validate --config /etc/caddy/Caddyfile` — valid configuration. - Serve the generated `_site` with the Caddy config on local HTTP and issue a HEAD request — returns `frame-ancestors 'none'`, `X-Frame-Options: DENY`, `nosniff`, the strict-origin referrer policy, and the existing HSTS value. - `git diff --check` — passes. ## Production rollout 1. Back up and compare the current `/etc/caddy/Caddyfile` on `caution.co` with the tracked configuration. 2. Install the tracked configuration and run `caddy validate --config /etc/caddy/Caddyfile`. 3. Reload Caddy and verify both `https://caution.co/` and `https://www.caution.co/` with `curl -sSI`. Rollback: restore the previous Caddyfile and reload Caddy.

This pull request can be merged automatically.

You are not authorized to merge this pull request.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin fix/clickjacking-headers:fix/clickjacking-headers

git switch fix/clickjacking-headers

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch main

git merge --no-ff fix/clickjacking-headers

git switch fix/clickjacking-headers

git rebase main

git switch main

git merge --ff-only fix/clickjacking-headers

git switch fix/clickjacking-headers

git rebase main

git switch main

git merge --no-ff fix/clickjacking-headers

git switch main

git merge --squash fix/clickjacking-headers