Adop 2703 cross origins policy header#1798
Open
NewmanJustice wants to merge 12 commits into
Open
Conversation
…ade helmet to v8 - Move /robots.txt and /sitemap.xml route handlers in server.ts to after Helmet middleware init, so CORP and all other security headers are applied to those responses (root cause of ZAP 90004 nightly failures) - Upgrade helmet from ^4.6.0 to ^8.0.0; update import to ESM-style and tighten TypeScript types in helmet/index.ts - Remove now-redundant audit.json suppressions for X-Content-Type-Options, HSTS and CSP on /robots.txt and /sitemap.xml (Helmet now covers these) - Add clarifying comments to Jenkinsfile_CNP and Jenkinsfile_nightly documenting ZAP scan targets (preview vs AAT) — closes OQ1 from spec Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
hmcts-jenkins-a-to-c
Bot
added
ns:adoption
prd:adoption
rel:adoption-web-pr-1798
labels
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
The checksum stored for helmet@npm:8.1.0 did not match the actual package archive on npm. In CI (no local cache), yarn install was downloading the package fresh, detecting the mismatch, and failing — leaving no .yarn/install-state.gz. This caused all subsequent yarn tasks (build, lint) to fail with 'Couldn't find the node_modules state file'. Regenerated the correct checksum by clearing the local cache and re-running yarn install. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
The CI audit script (yarn-audit-with-suppressions.sh) expected the suppressions file to be in Yarn 4 JSON-lines format but found a Yarn 3 single-object format entry, causing the check to fail with: 'Invalid or unexpected yarn-audit-known-issues-formatted structure' Regenerated using: yarn npm audit --recursive --environment production --json > yarn-audit-known-issues Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Before creating a pull request make sure that:
Change description
Fixes recurring ZAP security scan failures (rule 90004) where the Cross-Origin-Resource-Policy (CORP)
header was missing from /robots.txt and /sitemap.xml responses.
Root cause: The route handlers for /robots.txt and /sitemap.xml were registered in server.ts before the
Helmet middleware was initialised, so security headers were never applied to those responses.
Changes:
initialisation so CORP and all other security headers are applied.
and tightened TypeScript types for referrerPolicy and crossOriginResourcePolicy.
/robots.txt and /sitemap.xml.
(preview vs AAT).
JIRA link
[ADOP-2703]
Does this PR introduce a breaking change? (check one with "x")