Description

This pull request introduces a Content Security Policy (CSP) to the devFind application. The CSP is designed to enhance the security of the application by restricting the sources from which content can be loaded. This helps to reduce the risk of cross-site scripting (XSS) and other injection attacks.

Related Issues

1117

Changes Proposed

Added a CSP meta tag to the main HTML file with the following directives:
- default-src 'none';: Disallows all content by default.
- script-src 'self' 'unsafe-inline';: Allows scripts only from the same origin and inline scripts.
- style-src 'self' 'unsafe-inline' https://fonts.googleapis.com;: Permits styles from the same origin, inline styles, and Google Fonts.
- font-src 'self' https://fonts.gstatic.com;: Restricts font loading to the same origin and Google Fonts.
- img-src 'self' https://github.com/ https://avatars.githubusercontent.com/ https://pbs.twimg.com;: Allows images from the same origin, GitHub, and Twitter.
- manifest-src 'self';: Restricts the web app manifest to the same origin.
- connect-src 'self';: Limits network connections to the same origin.
- base-uri 'self';: Ensures that the base URL is restricted to the same origin.
- form-action 'self';: Restricts form submissions to the same origin.

Checklist

[x] I have read and followed the Contribution Guidelines.
[x] All new and existing tests passed.
[ ] I have updated the documentation to reflect the changes I've made.
[x] My code follows the code style of this project.
[x] The title of my pull request is a short description of the requested changes.

Screenshots

Screenshot

Note to reviewers

Please review the CSP configuration to ensure it does not inadvertently block legitimate content. Testing across various environments is recommended to verify that all functionality remains intact while enhancing security.

shyamtawli / devFind

Add Content Security Policy (CSP) to enhance security #1118