feat: use wildcard for readspeaker directives#38
Conversation
laravdiemen
requested review from
Rovasch,
ShunLuk,
SimonvanWijhe,
dtakken,
ictbeheer,
mvdhoek1 and
rivanuff
There was a problem hiding this comment.
Pull request overview
This PR updates the Content Security Policy (CSP) configuration to be more resilient to ReadSpeaker endpoint/domain changes by using a wildcard host source instead of an explicit subdomain allowlist.
Changes:
- Replaced explicit ReadSpeaker subdomain lists with
https://*.readspeaker.comacross relevant CSP directives. - Simplified ReadSpeaker CSP configuration by using a single wildcard pattern for connect/style/form-action/frame/media sources.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| ->addDirective(Directive::CONNECT, 'https://*.readspeaker.com') | ||
| ->addDirective(Directive::STYLE, 'https://*.readspeaker.com') | ||
| ->addDirective(Directive::FORM_ACTION, 'https://*.readspeaker.com') | ||
| ->addDirective(Directive::FRAME, 'https://*.readspeaker.com') | ||
| ->addDirective(Directive::MEDIA, 'https://*.readspeaker.com') |
There was a problem hiding this comment.
Switching the ReadSpeaker allowlist to https://*.readspeaker.com significantly broadens the CSP compared to the previous explicit subdomain list (especially for form-action and frame-src). This weakens the protection against unintended form posts / framing to unexpected ReadSpeaker subdomains. Consider keeping FORM_ACTION and FRAME restricted to the minimal required hosts (or add a brief inline comment explaining why the broader wildcard is acceptable here).
There was a problem hiding this comment.
@ictbeheer wat vind jij van deze suggestie? Moet ik daar de wilcard niet gebruiken?
There was a problem hiding this comment.
Ja, ik moet Copilot hier wel gelijk in geven, net als voor MEDIA trouwens
There was a problem hiding this comment.
Ik heb het aangepast, alleen CONNECT en STYLE is nu nog de wildcard
laravdiemen
force-pushed
the
feat/readspeaker-wildcard
branch
from
a40fae1 to
fb1e839
Compare
Aangezien readspeaker nogal vaak hun url aanpast, gebruiken we nu een wildcard om te voorkomen dat we het steeds opnieuw moeten toevoegen.