diff --git a/CSP-TEST-RESULTS.md b/CSP-TEST-RESULTS.md deleted file mode 100644 index eac1c73..0000000 --- a/CSP-TEST-RESULTS.md +++ /dev/null @@ -1,233 +0,0 @@ - -# ๐Ÿ›ก๏ธ CSP Testing Results - Pre-Deployment Verification - -## Test Date: Thursday, November 6, 2025 - -### โœ… CSP Header Verification - -**Status:** CSP is properly configured and active - -**Current CSP Policy:** -``` -Content-Security-Policy: - default-src 'self' https://365devnet.eu https://*.365devnet.eu; - script-src 'self' 'unsafe-inline' 'wasm-unsafe-eval' https://chat.365devnet.eu; - style-src 'self' 'unsafe-inline'; - img-src 'self' data: https: blob:; - font-src 'self' data:; - connect-src 'self' https://365devnet.eu https://*.365devnet.eu https://chat.365devnet.eu https://git.365devnet.eu wss://chat.365devnet.eu; - frame-src 'self' https://chat.365devnet.eu; - frame-ancestors 'none'; - base-uri 'self'; - form-action 'self' -``` - -### ๐Ÿ” External Resource Audit - -All external domains have been identified and added to CSP: - -| Resource | Domain | CSP Directive | Status | -|----------|--------|---------------|--------| -| Latest Commits | `https://git.365devnet.eu` | `connect-src` | โœ… Added | -| RocketChat Widget | `https://chat.365devnet.eu` | `script-src`, `connect-src`, `frame-src` | โœ… Included | -| RocketChat WebSocket | `wss://chat.365devnet.eu` | `connect-src` | โœ… Included | -| Images (any HTTPS) | `https:` | `img-src` | โœ… Wildcard | -| Internal APIs | `https://*.365devnet.eu` | `connect-src` | โœ… Wildcard | -| Uptime Kuma | Server-side only | N/A | โœ… No CSP needed | - -### ๐Ÿ“Š Client-Side vs Server-Side Calls - -**Client-side calls (affected by CSP):** -- `/api/commits` โ†’ Internal (OK) -- `/api/contact` โ†’ Internal (OK) -- `/api/uptime` โ†’ Internal (OK) -- RocketChat widget โ†’ `chat.365devnet.eu` (Added to CSP) - -**Server-side calls (NOT affected by CSP):** -- API routes fetch from `git.365devnet.eu` โœ… -- API routes fetch from `UPTIME_KUMA_URL` โœ… - -### ๐Ÿงช Testing Performed - -#### 1. Build Test -```bash -npm run build -``` -**Result:** โœ… Build successful (astro-compress warning is harmless) - -#### 2. CSP Enabled Server Test -```bash -ENABLE_SSR_CSP=1 npm run start -``` -**Result:** โœ… Server started successfully on port 3000 - -#### 3. CSP Header Present -```bash -curl -I http://localhost:3000/en/ -``` -**Result:** โœ… CSP header is present and correctly formatted - -### ๐ŸŽฏ Key Fixes Applied - -#### Fix #1: Added `git.365devnet.eu` to `connect-src` -**Problem:** Latest Commits widget was calling Gitea API but domain wasn't in CSP -**Solution:** Added `https://git.365devnet.eu` to `connect-src` - -#### Fix #2: Made `img-src` more permissive -**Problem:** Too restrictive, only allowed specific domains -**Solution:** Changed to `https:` to allow all HTTPS images - -#### Fix #3: Added wildcard subdomain support -**Problem:** Only specific subdomains were allowed -**Solution:** Added `https://*.365devnet.eu` to `connect-src` - -#### Fix #4: Kept `'unsafe-inline'` for scripts -**Problem:** Astro's inline scripts require this directive -**Solution:** Included `'unsafe-inline'` in `script-src` - -### โš ๏ธ Manual Testing Required - -Before deploying to production, **manually test these features** with CSP enabled: - -**Test URL:** http://localhost:3000/en/ (with `npm run dev:prod` or `ENABLE_SSR_CSP=1 npm run start`) - -#### Features to Test: - -- [ ] **Mobile Menu Toggle** - - Open site on mobile (or use browser DevTools responsive mode) - - Click hamburger menu icon - - Menu should expand/collapse - - Check console for CSP violations - -- [ ] **Language Selector** - - Desktop: Click language dropdown - - Select different language - - Page should reload with new language - - Mobile: Use select dropdown - -- [ ] **Theme Switcher** - - Click sun/moon icon - - Theme should toggle between light/dark - - Preference should persist - -- [ ] **Contact Form** - - Fill out form - - Submit - - Check for successful submission - - Check console for CSP violations - -- [ ] **Latest Commits Widget** โ† Critical test! - - Navigate to `/en/development/` - - Widget should load commit history - - Check browser console for errors - - Verify commits are displayed - -- [ ] **RocketChat Widget** - - Widget should appear in bottom right - - Should be clickable and functional - - Check console for CSP violations - -- [ ] **Smooth Scrolling** - - Click any anchor link (e.g., "Services" in nav) - - Page should scroll smoothly - - No console errors - -- [ ] **Images Loading** - - All images should load correctly - - Check different pages - - No broken images - -### ๐Ÿ”ง Debugging Tips - -#### If Something Doesn't Work: - -1. **Open Browser DevTools** (F12) -2. **Go to Console tab** -3. **Look for red CSP violation errors:** - ``` - Refused to load ... because it violates CSP directive... - ``` - -4. **Identify the blocked resource:** - - What domain? - - What type? (script, style, image, fetch, etc.) - -5. **Add to appropriate CSP directive:** - - Scripts โ†’ `script-src` - - API calls โ†’ `connect-src` - - Images โ†’ `img-src` - - Styles โ†’ `style-src` - -6. **Rebuild and test again** - -### ๐Ÿ“ Deployment Checklist - -Before enabling CSP in production: - -- [ ] Run `npm run dev:prod` locally -- [ ] Complete all manual tests above -- [ ] Check browser console (no CSP violations) -- [ ] Test on Chrome, Firefox, and Safari -- [ ] Test on actual mobile device -- [ ] Verify Latest Commits widget works -- [ ] Verify RocketChat widget works -- [ ] Document any new CSP changes - -### ๐Ÿš€ Deployment Instructions - -#### Option 1: Full Test (Recommended) -```bash -# Build and test locally with CSP -npm run dev:prod - -# Manual testing... - -# If all tests pass, rebuild Docker -docker-compose up -d --build -``` - -#### Option 2: Direct Deploy (Use with caution) -```bash -# Make sure ENABLE_SSR_CSP=1 is in docker-compose.yml -docker-compose up -d --build - -# Monitor logs -docker-compose logs -f web - -# Check production site immediately -# Open browser DevTools and check console -``` - -### ๐Ÿ“Š Confidence Level - -**Current Status:** -- โœ… CSP policy created and verified -- โœ… All external domains identified -- โœ… Server runs with CSP enabled -- โœ… CSP header present in responses -- โš ๏ธ Manual browser testing required - -**Confidence for Production:** 85% - -**Why not 100%?** Manual browser testing of interactive features (mobile menu, language selector, Latest Commits widget) has not been performed with CSP enabled. This requires opening a browser and testing each feature while monitoring the console for CSP violations. - -### ๐ŸŽฏ Recommendation - -**Before deploying to production:** - -1. Run `npm run dev:prod` -2. Open http://localhost:3000/en/ in your browser -3. Open DevTools Console (F12) -4. Test each interactive feature -5. Verify NO CSP violation errors appear -6. **Especially test Latest Commits widget** - this was the main issue! - -If all tests pass โ†’ **Deploy with confidence!** โœ… -If CSP violations appear โ†’ **Document them and add domains to CSP** ๐Ÿ”ง - ---- - -**Test performed by:** AI Assistant -**Manual verification required by:** User -**Next step:** Manual browser testing with `npm run dev:prod` - diff --git a/src/components/widgets/BrandMarquee.astro b/src/components/widgets/BrandMarquee.astro index cb995e6..04d3048 100644 --- a/src/components/widgets/BrandMarquee.astro +++ b/src/components/widgets/BrandMarquee.astro @@ -58,7 +58,7 @@ const speedClass = { ---
-
+
{subtitle && ( diff --git a/src/components/widgets/Contact.astro b/src/components/widgets/Contact.astro index c23ae77..4816b1e 100644 --- a/src/components/widgets/Contact.astro +++ b/src/components/widgets/Contact.astro @@ -22,7 +22,7 @@ const { } = Astro.props; --- - + { diff --git a/src/components/widgets/Content.astro b/src/components/widgets/Content.astro index ab62dc3..998c228 100644 --- a/src/components/widgets/Content.astro +++ b/src/components/widgets/Content.astro @@ -28,7 +28,7 @@ const { -
+
{ diff --git a/src/components/widgets/Features.astro b/src/components/widgets/Features.astro index 7650cd7..10249e0 100644 --- a/src/components/widgets/Features.astro +++ b/src/components/widgets/Features.astro @@ -20,7 +20,7 @@ const { } = Astro.props; --- - + } />
diff --git a/src/components/widgets/Header.astro b/src/components/widgets/Header.astro index 99e1983..652a7ea 100644 --- a/src/components/widgets/Header.astro +++ b/src/components/widgets/Header.astro @@ -105,7 +105,7 @@ const { 'md:grid md:grid-cols-3 md:items-center': position === 'center', }, { - 'max-w-7xl': !isFullWidth, + 'max-w-6xl': !isFullWidth, }, ]} > diff --git a/src/components/widgets/HeroText.astro b/src/components/widgets/HeroText.astro index e8274eb..33fae0d 100644 --- a/src/components/widgets/HeroText.astro +++ b/src/components/widgets/HeroText.astro @@ -23,7 +23,7 @@ const {
-
+
diff --git a/src/components/widgets/ModernAppliedSkills.astro b/src/components/widgets/ModernAppliedSkills.astro index dbb5ed7..9027f92 100644 --- a/src/components/widgets/ModernAppliedSkills.astro +++ b/src/components/widgets/ModernAppliedSkills.astro @@ -41,7 +41,7 @@ const getSkillGradient = (name: string): string => { }; --- - + { }; --- - + { }; --- - + 0) { } --- - + { }; --- - + -
+
๐Ÿ›ก๏ธ
diff --git a/src/pages/[lang]/development.astro b/src/pages/[lang]/development.astro index 6b69f05..7fc4fc2 100644 --- a/src/pages/[lang]/development.astro +++ b/src/pages/[lang]/development.astro @@ -56,7 +56,7 @@ const averagePerDay = contributionDays > 0 ? (totalContributions / contributionD --- -
+
๐Ÿ‘จโ€๐Ÿ’ป
diff --git a/src/pages/[lang]/eap.astro b/src/pages/[lang]/eap.astro index 6dee9d3..3702c1f 100644 --- a/src/pages/[lang]/eap.astro +++ b/src/pages/[lang]/eap.astro @@ -25,7 +25,7 @@ const metadata = { --- -
+
๐Ÿ›ก๏ธ
diff --git a/src/pages/[lang]/focusedyoutube.astro b/src/pages/[lang]/focusedyoutube.astro index 9e09272..2eb897d 100644 --- a/src/pages/[lang]/focusedyoutube.astro +++ b/src/pages/[lang]/focusedyoutube.astro @@ -24,7 +24,7 @@ const metadata = { --- -
+
๐ŸŽฌ
diff --git a/src/pages/[lang]/journii.astro b/src/pages/[lang]/journii.astro index 36217aa..3dd5cf3 100644 --- a/src/pages/[lang]/journii.astro +++ b/src/pages/[lang]/journii.astro @@ -28,7 +28,7 @@ const metadata = { --- -
+
๐Ÿš—
diff --git a/src/pages/[lang]/privacy.astro b/src/pages/[lang]/privacy.astro index 92bd768..a57fabe 100644 --- a/src/pages/[lang]/privacy.astro +++ b/src/pages/[lang]/privacy.astro @@ -64,12 +64,12 @@ function parseAndFormatTime(rawTime) { '@type': 'Article', headline: 'Privacy Policy', datePublished: '2025-03-06', - dateModified: '2025-06-07', + dateModified: '2025-11-06', }, }} /> -
+
๐Ÿ”
@@ -80,7 +80,7 @@ function parseAndFormatTime(rawTime) { Transparent data practices and your privacy rights

- ๐Ÿ“… Last updated: 07 June 2025 + ๐Ÿ“… Last updated: 06 November 2025
@@ -374,9 +374,21 @@ function parseAndFormatTime(rawTime) { to us. However, please be aware that no method of transmission over the internet or method of electronic storage is 100% secure.

-
-

- HTTPS Encryption: Our website uses HTTPS encryption to ensure that any communication between your browser and our website is secure. +

+
+

+ ๐Ÿ”’ HTTPS Encryption: All communication between your browser and our website is encrypted using industry-standard HTTPS protocol. +

+
+
+

+ ๐Ÿ›ก๏ธ Content Security Policy: We implement Content Security Policy (CSP) headers to prevent cross-site scripting (XSS) and other code injection attacks. +

+
+
+
+

+ Security Headers: Our website employs multiple security headers including X-Content-Type-Options, Referrer-Policy, and Cross-Origin policies to protect against common web vulnerabilities.

diff --git a/src/pages/[lang]/syncera.astro b/src/pages/[lang]/syncera.astro index 6e37b86..e2f9a4c 100644 --- a/src/pages/[lang]/syncera.astro +++ b/src/pages/[lang]/syncera.astro @@ -330,7 +330,7 @@ const metadata = { --- -
+
๐Ÿ’ช
diff --git a/src/pages/[lang]/terms.astro b/src/pages/[lang]/terms.astro index a76b424..0a29b66 100644 --- a/src/pages/[lang]/terms.astro +++ b/src/pages/[lang]/terms.astro @@ -59,7 +59,7 @@ const tocItems = [ }} /> -
+
๐Ÿ“‹
diff --git a/src/pages/[lang]/uptime.astro b/src/pages/[lang]/uptime.astro index fc484c5..dcbcf3d 100644 --- a/src/pages/[lang]/uptime.astro +++ b/src/pages/[lang]/uptime.astro @@ -48,7 +48,7 @@ const metadata = { --- -
+

{t.uptime.title}