From d8c947f88fc4c04f74795f2402cd37beb0a71b0e Mon Sep 17 00:00:00 2001
From: Rene Luria <rene.luria@infomaniak.com>
Date: Wed, 8 Jul 2026 13:50:23 +0200
Subject: [PATCH] fix(security): add nonce-based CSP header to frontend route

---
 main.py            | 21 ++++++++++++++++++++-
 tests/test_main.py | 20 ++++++++++++++++++++
 2 files changed, 40 insertions(+), 1 deletion(-)

diff --git a/main.py b/main.py
index 2c46d08..2d25ee8 100644
--- a/main.py
+++ b/main.py
@@ -7,6 +7,7 @@ from typing import Optional
 import jwt
 import requests
 import os
+import secrets
 from functools import lru_cache
 
 app = FastAPI(title="OIDC Token Validator")
@@ -326,9 +327,27 @@ async def validate_token(request: TokenValidationRequest):
 @app.get("/", response_class=HTMLResponse)
 async def read_root():
     """Serve the frontend HTML file"""
+    nonce = secrets.token_urlsafe(16)
     with open("templates/index.html", "r") as file:
         html_content = file.read()
-    return HTMLResponse(content=html_content, status_code=200)
+    html_content = html_content.replace(
+        '<script>', f'<script nonce="{nonce}">', 1
+    )
+    csp = (
+        "default-src 'self'; "
+        f"script-src 'self' 'nonce-{nonce}' https://cdn.jsdelivr.net; "
+        "style-src 'self' https://cdn.jsdelivr.net; "
+        "connect-src 'self' https://login.infomaniak.com https://api.coingecko.com; "
+        "img-src 'self'; "
+        "object-src 'none'; "
+        "base-uri 'self'; "
+        "frame-ancestors 'none'"
+    )
+    return HTMLResponse(
+        content=html_content,
+        status_code=200,
+        headers={"Content-Security-Policy": csp},
+    )
 
 @app.get("/health")
 async def health_check():
diff --git a/tests/test_main.py b/tests/test_main.py
index 5d1a9ee..fedc6fa 100644
--- a/tests/test_main.py
+++ b/tests/test_main.py
@@ -31,6 +31,26 @@ def test_get_client_config():
     assert isinstance(data["client_id"], str)
     assert len(data["client_id"]) > 0
 
+def test_root_serves_csp_with_nonce():
+    """Test that GET / returns a CSP header with a nonce and the inline script carries it."""
+    response = client.get("/")
+    assert response.status_code == 200
+    csp = response.headers.get("content-security-policy", "")
+    assert "nonce-" in csp
+    assert "script-src" in csp
+    assert "cdn.jsdelivr.net" in csp
+    assert "connect-src" in csp
+    assert "login.infomaniak.com" in csp
+    assert "api.coingecko.com" in csp
+    assert "object-src 'none'" in csp
+    body = response.text
+    assert "<script nonce=" in body
+    import re
+    match = re.search(r"nonce-([A-Za-z0-9_-]+)", csp)
+    assert match is not None
+    nonce = match.group(1)
+    assert f'nonce="{nonce}"' in body
+
 @patch('main.verify_token')
 def test_validate_token_success(mock_verify_token):
     """Test successful token validation."""