From 6ff353b94a0eb8e68fbbd939faa253075684a193 Mon Sep 17 00:00:00 2001
From: Mikhail Yenuchenko <public@mixeme.ru>
Date: Sat, 1 Aug 2026 23:02:02 +0300
Subject: [PATCH] panel: security headers and an origin check on unsafe methods
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Phase 14.A, both halves of it in one middleware wrapped around the whole
router — outside requireAuth, so POST /login and POST /setup/{token} are
covered too.

Headers: CSP, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, and
HSTS only where the deployment is HTTPS-only (the same CookieSecure condition
that gates the cookie's Secure attribute; on the plain-HTTP dev instance HSTS
would pin the browser to a scheme that instance does not speak). HSTS goes
without includeSubDomains on purpose: the panel may sit at an apex, and
forcing HTTPS on every unrelated subdomain of the operator's domain for a year
is not this project's call. They are emitted here rather than delegated to the
reverse proxy, so the part that is easy to get wrong lives in the service.

Origin check: this is what SameSite=Lax cannot do. SameSite is judged per site
(registrable domain), so a neighbouring host — a CMS, a forgotten staging
subdomain — is same-site and its forged POST arrives with the session cookie
attached. Sec-Fetch-Site and Origin are judged per origin and tell it apart.
For the typical deployment, where the panel is a subdomain of a domain used
for other things, that neighbour is the realistic attacker, not a theoretical
one; POST /domains/import is the case that turns a blind write into working
credentials on someone else's relay.

A request carrying neither header is still let through — the risk accepted in
the plan, since a client that old cannot be checked at all and the strict mode
would not protect it, only break the panel in it.

The check compares Origin's host against r.Host, not the full origin: the
panel speaks plain HTTP behind the proxy and does not know its own external
scheme. That makes it depend on the proxy preserving Host. All four shipped
fragments do, but one that rewrites it would turn every form submission into a
403, so the rejection logs both sides of the comparison — otherwise the
symptom reads as "the panel stopped saving anything".

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 internal/web/security.go      | 126 +++++++++++++++++++++++++++++++++
 internal/web/security_test.go | 129 ++++++++++++++++++++++++++++++++++
 internal/web/web.go           |   4 +-
 3 files changed, 258 insertions(+), 1 deletion(-)
 create mode 100644 internal/web/security.go
 create mode 100644 internal/web/security_test.go

diff --git a/internal/web/security.go b/internal/web/security.go
new file mode 100644
index 0000000..b2eb1d4
--- /dev/null
+++ b/internal/web/security.go
@@ -0,0 +1,126 @@
+package web
+
+import (
+	"net/http"
+	"net/url"
+)
+
+// contentSecurityPolicy is the panel's CSP. Everything the pages load —
+// stylesheet, HTMX, the panel's own script, the favicon — is served from
+// /static by this same origin, and no template carries an inline <script>,
+// an inline event handler or a style="..." attribute (phase 14.A; the
+// template guard test enforces that), so 'self' needs no exemptions:
+//
+//   - default-src 'self' covers scripts, styles, images and the XHR that
+//     HTMX's polling fragments use;
+//   - object-src/frame-ancestors 'none' remove plugin embedding and framing
+//     (clickjacking) outright;
+//   - base-uri 'none' stops an injected <base> from re-pointing every
+//     relative URL on the page, including the form actions;
+//   - form-action 'self' keeps a form from being retargeted at another host.
+//
+// This is a second line of defence: XSS is already prevented by
+// html/template's contextual auto-escaping (spec 7.6.7).
+const contentSecurityPolicy = "default-src 'self'; " +
+	"object-src 'none'; " +
+	"base-uri 'none'; " +
+	"form-action 'self'; " +
+	"frame-ancestors 'none'"
+
+// strictTransportSecurity is sent only when the deployment is HTTPS-only
+// (CookieSecure, the same condition that gates the cookie's Secure attribute):
+// on the plain-HTTP development setup it would be meaningless at best and
+// would pin the browser to a scheme the dev instance does not speak at worst.
+//
+// Deliberately without includeSubDomains. The panel commonly lives on a
+// subdomain of a domain used for other things, but it may also sit at the
+// apex — and there the directive would force HTTPS on every unrelated
+// subdomain of that domain for a year, which is not SelfPost's call to make.
+const strictTransportSecurity = "max-age=31536000"
+
+// secure wraps the whole router with the panel's two transport-level defences
+// (phase 14.A): the security response headers, and an origin check on every
+// state-changing request.
+//
+// It sits outside the authentication middleware on purpose, so that POST
+// /login and POST /setup/{token} are covered too.
+func (s *Server) secure(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		h := w.Header()
+		h.Set("Content-Security-Policy", contentSecurityPolicy)
+		h.Set("X-Content-Type-Options", "nosniff")
+		// Equivalent to the CSP's frame-ancestors directive, kept for browsers
+		// that predate it. The two never disagree: both mean "never framed".
+		h.Set("X-Frame-Options", "DENY")
+		// The panel's behaviour never depends on the referrer, so the strictest
+		// value is free: panel URLs carry domain names and record identifiers
+		// that need not leak to anything the administrator clicks through to.
+		h.Set("Referrer-Policy", "no-referrer")
+		if s.cfg.CookieSecure {
+			h.Set("Strict-Transport-Security", strictTransportSecurity)
+		}
+
+		if !originAllowed(r) {
+			// Log both sides of the comparison. The check depends on r.Host
+			// being the name the browser actually used, which every reverse
+			// proxy fragment this project ships preserves (Apache
+			// ProxyPreserveHost On, nginx proxy_set_header Host $host, Caddy
+			// and Traefik by default) — but a proxy that rewrites Host turns
+			// every form submission into a 403, and without these two values
+			// side by side the symptom just looks like "the panel stopped
+			// saving anything".
+			logf("panel: rejected %s %s: cross-origin request (Sec-Fetch-Site=%q Origin=%q Host=%q); "+
+				"if this was a legitimate request, check that the reverse proxy passes the original Host header through",
+				r.Method, r.URL.Path, r.Header.Get("Sec-Fetch-Site"), r.Header.Get("Origin"), r.Host)
+			http.Error(w, "cross-origin request rejected", http.StatusForbidden)
+			return
+		}
+
+		next.ServeHTTP(w, r)
+	})
+}
+
+// originAllowed reports whether a state-changing request came from the panel's
+// own origin (phase 14.A). This is what the session cookie's
+// SameSite=Lax attribute cannot do on its own: SameSite is judged per *site*
+// (registrable domain), so a neighbouring subdomain — a CMS on the same
+// domain, a forgotten staging host — counts as same-site and its forged POST
+// would arrive with the session cookie attached. Sec-Fetch-Site and Origin are
+// judged per *origin*, so they tell that neighbour apart from the panel.
+//
+// Read-only methods are exempt: every GET route in the panel is a read (the
+// delete confirmation at GET /domains/{id}/delete only renders a form), so
+// there is nothing for a cross-origin GET to change.
+func originAllowed(r *http.Request) bool {
+	switch r.Method {
+	case http.MethodGet, http.MethodHead, http.MethodOptions:
+		return true
+	}
+
+	// The browser's own account of where the request came from. It cannot be
+	// set by page script (a forbidden header name), so when it is present it
+	// is the answer: anything but same-origin — including "none", a
+	// navigation with no initiator — is refused.
+	if site := r.Header.Get("Sec-Fetch-Site"); site != "" {
+		return site == "same-origin"
+	}
+
+	// Older browsers send only Origin. Compare hosts, not full origins: the
+	// panel speaks plain HTTP behind the proxy and does not know its own
+	// external scheme, while Origin will say https.
+	origin := r.Header.Get("Origin")
+	if origin == "" {
+		// Neither header. A client this old cannot be checked at all; it is
+		// let through as the risk consciously accepted for phase 14.A
+		// (single-admin panel, the administrator picks the browser). Turning
+		// this return into false is the whole of the stricter policy.
+		return true
+	}
+	u, err := url.Parse(origin)
+	if err != nil || u.Host == "" {
+		// Unparseable, or the opaque "null" origin (sandboxed iframe,
+		// redirected cross-origin POST) — not this panel either way.
+		return false
+	}
+	return u.Host == r.Host
+}
diff --git a/internal/web/security_test.go b/internal/web/security_test.go
new file mode 100644
index 0000000..ce45a54
--- /dev/null
+++ b/internal/web/security_test.go
@@ -0,0 +1,129 @@
+package web
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+)
+
+// serveSecured runs one request through the security middleware and reports
+// what came out. The wrapped handler answers 200, so any other status is the
+// middleware's doing.
+func serveSecured(cookieSecure bool, r *http.Request) *httptest.ResponseRecorder {
+	s := &Server{cfg: Config{CookieSecure: cookieSecure}}
+	h := s.secure(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.WriteHeader(http.StatusOK)
+	}))
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, r)
+	return rec
+}
+
+// post builds a request as a browser would send it to the panel's own host.
+func post(secFetchSite, origin string) *http.Request {
+	r := httptest.NewRequest(http.MethodPost, "http://panel.example.com/domains", nil)
+	r.Host = "panel.example.com"
+	if secFetchSite != "" {
+		r.Header.Set("Sec-Fetch-Site", secFetchSite)
+	}
+	if origin != "" {
+		r.Header.Set("Origin", origin)
+	}
+	return r
+}
+
+// The full matrix the origin check has to get right (phase 14.A). The row that
+// matters most is "same-site": a neighbouring host on example.com is same-site
+// as far as the session cookie's SameSite=Lax is concerned, so this check is
+// the only thing standing between it and a forged POST.
+func TestOriginCheck(t *testing.T) {
+	tests := []struct {
+		name         string
+		req          *http.Request
+		wantRejected bool
+	}{
+		{"no headers at all is let through (accepted risk)", post("", ""), false},
+		{"same-origin", post("same-origin", "https://panel.example.com"), false},
+		{"same-site, i.e. a neighbouring subdomain", post("same-site", ""), true},
+		{"cross-site", post("cross-site", "https://evil.example.net"), true},
+		{"none, a navigation with no initiator", post("none", ""), true},
+		{"Sec-Fetch-Site outranks a matching Origin", post("cross-site", "https://panel.example.com"), true},
+		{"Origin host matches", post("", "https://panel.example.com"), false},
+		{"Origin host differs", post("", "https://evil.example.net"), true},
+		{"Origin differs from a neighbour only in host", post("", "https://cms.example.com"), true},
+		{"opaque null Origin", post("", "null"), true},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			rec := serveSecured(true, tc.req)
+			rejected := rec.Code == http.StatusForbidden
+			if rejected != tc.wantRejected {
+				t.Fatalf("status = %d, rejected = %t, want rejected = %t", rec.Code, rejected, tc.wantRejected)
+			}
+		})
+	}
+}
+
+// The proxy terminates TLS and forwards plain HTTP, so the panel never learns
+// its own external scheme: comparing it against the https in Origin would
+// reject every legitimate form submission in the documented deployment.
+func TestOriginCheckIgnoresScheme(t *testing.T) {
+	rec := serveSecured(true, post("", "https://panel.example.com"))
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status = %d, want 200: an https Origin against a plain-HTTP panel must pass", rec.Code)
+	}
+}
+
+// Every GET route in the panel is a read, so cross-origin reads have nothing
+// to change and must not be blocked — the HTMX polling fragments included.
+func TestOriginCheckExemptsReads(t *testing.T) {
+	for _, method := range []string{http.MethodGet, http.MethodHead} {
+		r := httptest.NewRequest(method, "http://panel.example.com/status/fragment", nil)
+		r.Host = "panel.example.com"
+		r.Header.Set("Sec-Fetch-Site", "cross-site")
+		if rec := serveSecured(true, r); rec.Code != http.StatusOK {
+			t.Errorf("%s: status = %d, want 200", method, rec.Code)
+		}
+	}
+}
+
+func TestSecurityHeaders(t *testing.T) {
+	rec := serveSecured(true, httptest.NewRequest(http.MethodGet, "http://panel.example.com/status", nil))
+	want := map[string]string{
+		"Content-Security-Policy":   contentSecurityPolicy,
+		"X-Content-Type-Options":    "nosniff",
+		"X-Frame-Options":           "DENY",
+		"Referrer-Policy":           "no-referrer",
+		"Strict-Transport-Security": strictTransportSecurity,
+	}
+	for name, value := range want {
+		if got := rec.Header().Get(name); got != value {
+			t.Errorf("%s = %q, want %q", name, got, value)
+		}
+	}
+}
+
+// HSTS is the one header that must not be sent unconditionally: on the
+// plain-HTTP development instance it would pin the browser to a scheme that
+// instance does not speak.
+func TestHSTSOnlyWhenSecure(t *testing.T) {
+	rec := serveSecured(false, httptest.NewRequest(http.MethodGet, "http://panel.example.com/status", nil))
+	if got := rec.Header().Get("Strict-Transport-Security"); got != "" {
+		t.Errorf("Strict-Transport-Security = %q on a non-secure deployment, want none", got)
+	}
+	if got := rec.Header().Get("Content-Security-Policy"); got == "" {
+		t.Error("the other security headers must still be sent without TLS")
+	}
+}
+
+// A rejected request is still a response the browser renders, so it carries
+// the same headers as any other.
+func TestRejectedRequestKeepsSecurityHeaders(t *testing.T) {
+	rec := serveSecured(true, post("cross-site", ""))
+	if rec.Code != http.StatusForbidden {
+		t.Fatalf("status = %d, want 403", rec.Code)
+	}
+	if got := rec.Header().Get("Content-Security-Policy"); got != contentSecurityPolicy {
+		t.Errorf("Content-Security-Policy = %q on the 403 response, want the policy", got)
+	}
+}
diff --git a/internal/web/web.go b/internal/web/web.go
index 7c27d1d..a124560 100644
--- a/internal/web/web.go
+++ b/internal/web/web.go
@@ -181,7 +181,9 @@ func (s *Server) Handler() http.Handler {
 
 	mux.Handle("/", s.requireAuth(authed))
 
-	return mux
+	// Security headers and the origin check wrap everything, including the
+	// unauthenticated login and setup routes (phase 14.A).
+	return s.secure(mux)
 }
 
 // redirectToStatus points the panel root at the status page, so there is one