mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-08 11:46:35 +00:00
kevinveenbirkenbachandClaude Opus 4.7
e746368c20
Browser vendors deprecated X-Frame-Options/X-XSS-Protection/X-Download-Options/ X-Permitted-Cross-Domain-Policies; CSP (rendered from each role's meta/server.yml via build_csp_header) is the modern replacement. To make the SPOT actually win against upstream apps (e.g. Keycloak/Quarkus still emits X-Frame-Options), the proxy now hides those headers on every location type. Includes a fail-loud lint that catches any future add_header / Header set/add re-introduction in .conf / .conf.j2 / .htaccess / .j2 / .jinja / .tmpl files. - sys-svc-proxy: new upstream_strips.conf.j2 partial bundles HSTS + the 4 deprecated header strips; included in html/media/ws/upload + web-svc-logout + web-app-oauth2-proxy locations (nginx array-replacement inheritance forces per-location placement) - web-app-keycloak: meta/server.yml frame-ancestors allows the primary-domain wildcard with the dynamic TLS protocol so dashboard silent-check-sso iframe loads cleanly - web-app-dashboard/playwright: drop isOidcSilentCheckNoise — root cause is now fixed, no noise filter needed - web-app-dashboard/nginx + web-app-nextcloud/nginx: remove the deprecated add_header lines themselves - tests + docs: new lint registers `deprecated-http-header` suppression rule Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Test guidance 🧪
This directory contains contributor guidance for automated tests. Its scope is how lint, unit, integration, regression, and Playwright coverage should be structured, selected, and validated.