[JuliusHenke]

Requested by ju · project thread

Hardening based on the internet.nl website tests for tormap.org and api.tormap.org.

Changes

• security.txt (RFC 9116) at /.well-known/security.txt on both hosts, pointing to the GitHub advisory form and SECURITY.md. Expires is 180 days after the build (frontend) or the request (backend), so it never goes stale while the project is maintained.
  • Backend: new SecurityTxtController, explicitly permitted for GET in SecurityConfig, covered by SecurityRulesTest.
  • Frontend: small Vite plugin emits the file; it's left out of the service worker precache. firebase.json no longer ignores dot paths, so .well-known/ gets deployed.
• Frontend security headers on Firebase and in the nginx image (security-headers.conf, included in every location): Content-Security-Policy, X-Content-Type-Options: nosniff, X-Frame-Options: DENY, Referrer-Policy: no-referrer. The CSP allows scripts only from the own origin, images from the own origin, data:, the CARTO tile host and GitHub avatars, and connections only to the own origin and api.tormap.org. Styles need 'unsafe-inline', because MUI/Emotion inserts <style> elements at runtime and static hosting can't add per-request nonces.
• Backend default CSP now also sets form-action 'none'.
• nginx: server_tokens off, charset utf-8 for .well-known, missing .well-known files return 404 instead of index.html.
• THREAT_MODEL.md documents the frontend CSP and adds a checklist item for new external hosts.

Testing

• SecurityRulesTest, SecurityTxtControllerTest and the other config/controller tests pass; frontend unit tests (120) and lint pass.
• Served the build from the pinned nginx-unprivileged image with the new config and checked the headers on /, /assets/, /sw.js and /.well-known/.
• Loaded the app in Chromium with this CSP (API and tiles mocked): the map, panels, heatmap toggle, search and About dialog work, the service worker registers, and there are no CSP violations. With style-src 'self' only, MUI renders unstyled, which is why 'unsafe-inline' stays.
• Please click through the Firebase preview channel before merging, especially relay details and the date picker.

Deployment notes

The api.tormap.org reverse proxy should pass through /.well-known/security.txt and the backend's security headers.

---

Generated by Claude Code

[github-actions]

Visit the preview URL for this PR (updated for commit 397244e):

https://tormap-36f44--pr680-claude-project-threa-se84h1mr.web.app

_{(expires Fri, 06 Nov 2026 22:42:44 GMT)}

_{🔥 via Firebase Hosting GitHub Action 🌎}

_{Sign: 0c1f71965de18e60b0e686b0d0356977fec090dc}