Web Security Configuration
Overview
This document records the web security configuration for chrisnewcomb.name, covering HTTP security headers, Content Security Policy, DNS security, and TLS settings. All configuration is managed via the Cloudflare dashboard.
Content Security Policy (CSP)
CSP headers restrict which scripts, styles, and resources can load on the site, preventing XSS and injection attacks.
Configuration
Set via Cloudflare Transform Rules (Modify Response Headers):
| Header | Value |
|---|---|
| Content-Security-Policy | default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self' data:; connect-src 'self' https://giscus.app; frame-src https://giscus.app; object-src 'none'; base-uri 'self' |
Notes
The unsafe-inline and unsafe-eval directives are required by Docusaurus for inline scripts and React hydration. The frame-src allows Giscus comments (GitHub Discussions iframe). No external CDN scripts are loaded, so no additional script-src origins are needed.
How to configure
- Go to Cloudflare dashboard, select chrisnewcomb.name
- Rules, Transform Rules, Modify Response Header
- Create a rule matching all requests (
http.host eq "chrisnewcomb.name") - Add each header below as "Set" (static value)
Security Headers
Required Headers
Configure all of the following via the same Cloudflare Transform Rule:
| Header | Value | Purpose |
|---|---|---|
| X-Content-Type-Options | nosniff | Prevents MIME type sniffing |
| X-Frame-Options | DENY | Prevents clickjacking (backup for CSP frame-ancestors) |
| Referrer-Policy | strict-origin-when-cross-origin | Controls referrer information leakage |
| Permissions-Policy | camera=(), microphone=(), geolocation=(), payment=() | Disables unnecessary browser APIs |
| X-XSS-Protection | 0 | Disabled per modern best practice (CSP handles XSS) |
HSTS (HTTP Strict Transport Security)
Managed by Cloudflare automatically when SSL/TLS is set to Full (Strict). Verify in Cloudflare dashboard under SSL/TLS, Edge Certificates, and confirm "Always Use HTTPS" is enabled.
Subresource Integrity (SRI)
No external scripts are loaded by the Docusaurus site. All JavaScript and CSS is built and served from the same origin. SRI is not applicable unless external CDN resources are added in the future.
If external scripts are added, integrity hashes must be included. See the Plugin Policy for the approval process.
DNS Security
DNSSEC
Enable DNSSEC in Cloudflare dashboard under DNS, Settings. Cloudflare manages the signing keys. After enabling, add the DS record to the domain registrar as instructed by Cloudflare.
CAA Records
CAA (Certificate Authority Authorization) records restrict which certificate authorities can issue certificates for the domain. Add the following DNS records:
| Type | Name | Content |
|---|---|---|
| CAA | chrisnewcomb.name | 0 issue "digicert.com" |
| CAA | chrisnewcomb.name | 0 issue "letsencrypt.org" |
| CAA | chrisnewcomb.name | 0 issuewild ";" |
The issuewild ";" prevents wildcard certificate issuance by any CA.
DMARC/SPF/DKIM
If email is ever sent from the chrisnewcomb.name domain, configure:
| Type | Name | Content |
|---|---|---|
| TXT | _dmarc | v=DMARC1; p=reject; rua=mailto:dmarc@chrisnewcomb.name |
| TXT | @ | v=spf1 -all (if no email is sent from this domain) |
Currently no email is sent from this domain. The SPF -all record prevents spoofing.
TLS Configuration
Minimum TLS Version
Set to TLS 1.2 minimum in Cloudflare dashboard under SSL/TLS, Edge Certificates, Minimum TLS Version.
SSL/TLS Mode
Set to "Full (Strict)" in Cloudflare dashboard under SSL/TLS, Overview. This ensures end-to-end encryption between Cloudflare and the origin.
Certificate Transparency
Cloudflare automatically publishes certificates to CT logs. No additional configuration needed.
Always Use HTTPS
Ensure "Always Use HTTPS" is enabled under SSL/TLS, Edge Certificates. This redirects all HTTP requests to HTTPS.
Verification
After configuring headers, verify using:
Review Schedule
This document should be reviewed when:
- New external scripts or resources are added to the site
- Cloudflare SSL/TLS settings are modified
- Domain registrar or DNS provider changes
- Quarterly as part of general security review