Repository navigation
refactor(csp): delete the hashed-CSP rollout flag and the branch it guarded - #527
Merged
Merged
Conversation
Contributor
Wire-size diff vs merge base
Brotli q11, the quality the edge serves. Every number here is deterministic: Client assetsNo change. 22 files, 77.74 KiB Brotli total. PagesNo change. 50 files, 531.29 KiB Brotli total. Worker bundle237.91 KiB → 237.85 KiB gzip (-0.06 KiB, -0.0%) Largest module deltas (raw bytes in bundle):
Dictionary deltas (
|
Deploying with
|
| Status | Name | Latest Commit | Updated (UTC) |
|---|---|---|---|
| ✅ Deployment successful! View logs |
aadhar-sh | caa7568 | Aug 24 2026, 01:20 AM |
…uarded ENFORCE_PAGE_HASHES was pinned true on 2026-08-16 and nothing has flipped it in either direction since, so its false arm has been dead code for a week. It was not one line: it cost a second header name, a second tail constant, a `tail` parameter threaded through both policy builders to feed that constant, an entries loop in withSecurityHeaders whose only job was carrying a second header past a bail, and two branches apiece in the contract test and the twin-fact tripwire. The emitted policy is byte-identical, checked both ways. CSP_TAIL now holds the string CSP_TAIL_REPORTABLE plus "; upgrade-insecure-requests" used to compose, and a build of each side produces the same _headers line. cspHeadersFor returns exactly ONE header now. The contract test counts the keys rather than probing one name, since a twin under any other spelling is the same regression, and the upgrade-insecure-requests assertion inverts with the change: it used to check the twin OMITTED the directive, and with one policy left the only way to get it wrong is to lose it, so it now checks presence on both arms. gen-md-twins no longer reads the flag. It reads the header set cspHeadersFor actually emits, which is the better check for the reason the flag era proved: a flag states an intention, and #249's bug was the enforcing half never being applied to a single document while the flag said it was. /security claims 'unsafe-inline' left script-src, and that claim goes false the moment a report-only twin returns, so the deploy fails until one of the two is put right. Controls, both run: reintroducing a report-only twin fails the contract test by name (it reports the two keys it found) and fails the twin-fact tripwire by name. Reverting makes both green again. The rollout story stays. What the DevTools sweep found on /garage/horizon, and why the enforcing half had never been applied, are gotcha 17 in CLAUDE.md, which is where it belongs now that the mechanism is gone. Rolling back is `git revert` rather than a flag, and `bun run csp:sweep` is the signal that would call for one; its header says so instead of describing a flip that already happened. 353 tests, typecheck, lint, build, pages, photos and the 142-route oracle green. The build's taste warnings on this branch are the ones #525 fixes, not new.
oddharsh
force-pushed
the
claude/csp-drop-rollout-flag
branch
from
August 24, 2026 01:18
b26451b to
50b6e01
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
ENFORCE_PAGE_HASHESwas pinnedtrueon 2026-08-16 and nothing flipped it in either direction after that day, so its false arm has been dead code for a week.It was never one line. The flag cost a second header name, a second tail constant (
CSP_TAIL_REPORTABLE), atailparameter threaded through both policy builders purely to feed that constant, anObject.entriesloop inwithSecurityHeaderswhose only job was carrying a second header past a bail, and two branches apiece in the contract test and the twin-fact tripwire. Net −110/+92, and most of the insertions are the history note and the strengthened assertions.The emitted policy is byte-identical
Checked both directions.
CSP_TAILnow holds exactly the stringCSP_TAIL_REPORTABLE + "; upgrade-insecure-requests"used to compose, and building each side produces the same_headersline:cspHeadersFor returns exactly one header, and the test counts keys
The contract test now asserts
Object.keys(...)deep-equals["content-security-policy"]rather than probing one header name, because a twin under any other spelling is the same regression.The
upgrade-insecure-requestsassertion inverts with this change, which is the part worth reading. It used to check the twin OMITTED the directive, since a browser ignores a navigation directive in a report-only policy and files an issue per page load. With one policy left, the only way to get it wrong is to lose it, so it now asserts presence on both arms. Asserting the omission is what would have passed just as happily if the directive fell out of everything.The twin tripwire now reads headers instead of a flag
gen-md-twinsderived/security's rollout sentence fromENFORCE_PAGE_HASHES. It now derives it from whethercspHeadersForemits a report-only header at all.That is a better check for the reason the flag era itself proved: a flag states an intention, and #249's bug was the enforcing half never being applied to a single document while the flag said it was.
/securityclaims'unsafe-inline'leftscript-src; that claim goes false the moment a twin returns, so the deploy fails until one of the two is put right.Controls, both run
Reintroducing a report-only twin in
cspHeadersFor:src/worker/lib/security.ts no longer states its hashed-CSP enforcement stateReverting makes both green.
The rollout story stays, elsewhere
What the DevTools sweep found on
/garage/horizonand why the enforcing half had never been applied are gotcha 17 in CLAUDE.md, which is where they belong now the mechanism is gone. Rolling back isgit revertrather than a flag, andbun run csp:sweepis the signal that would call for one; its header now says that instead of describing a flip that already happened.Verification
353 tests, typecheck, lint, build,
pages:check,photos:check, twin facts, and the 142-route oracle green, re-run after rebasing onto #526.The build's taste warnings on this branch are the pre-existing ones #525 fixes, not new here.