lukas/webmail-client
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Security hardening from the assessment; testing fixes

Browse Source 
Security (ultimo-security-report.md):
- Security headers on every response, the app shell included: they lived at
  server level and nginx dropped them in any location with its own header.
  CSP, framing, nosniff, referrer, permissions (docker/nginx-security.conf).
- Plain HTTP forwarded by the reverse proxy is redirected to HTTPS; HSTS on
  HTTPS responses. server_tokens off.
- Cross-site state-changing /api requests refused (login CSRF), WebSocket too.
- Validation errors in the usual error shape, without the request model.
- New-password policy: max 128, common/own-address/repeated refused,
  breached-password check (HIBP k-anonymity, fails open).
- Message HTML: links keep only http(s)/mailto (sanitizer v6); the HTML
  endpoint carries its own no-script CSP.
- Outbound fetches pinned to the checked IP (DNS rebinding); external
  IMAP/SMTP servers re-checked before each connection; CGNAT and mapped
  addresses counted as non-public.

Fixes from testing:
- IDLE loop catches up before idling: mail that came while the worker was
  away no longer waits up to 10 minutes.
- Restore from Spam/Trash/Archive moves only the removed messages, not your
  reply in Sent.
- Narrow desktop list stacks sender/subject/snippet (subject was squeezed
  to nothing at the default width), with hover actions.
- Phone: wide emails scale to fit the screen.
- Singular forms ("1 message"); no zip button for a single attachment;
  app passwords no longer claim "never used" for mail apps.
- ruff format across the backend.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
lukas
2026-10-14 22:08:06 +02:00
co-authored by Claude Opus 5.5
parent 30b806e7da
commit addb2232a1
54 changed files with 1265 additions and 187 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docker/Dockerfile.frontend
+1
View File
@@ -30,6 +30,7 @@ COPY docker/nginx.conf /etc/nginx/conf.d/default.conf
# Shared server body, included by both listeners. Outside conf.d/ so nginx
# does not try to load it as a config of its own.
COPY docker/nginx-app.conf /etc/nginx/webmail-app.conf
COPY docker/nginx-security.conf /etc/nginx/webmail-security.conf
COPY --from=builder /src/dist /usr/share/nginx/html
# Surface the running version to `deploy/webmail.sh status` without needing the API.
docker/nginx-app.conf
+10 -5
View File
@@ -20,11 +20,10 @@ gzip_min_length 1024;
gzip_types text/plain text/css application/javascript application/json
image/svg+xml application/manifest+json;
# Clickjacking / sniffing basics. The app's own CSP for mail HTML is applied
# server-side in app/indexer/sanitize.py; this is only the shell document.
add_header X-Content-Type-Options nosniff always;
add_header X-Frame-Options SAMEORIGIN always;
add_header Referrer-Policy no-referrer always;
# Security headers (CSP, framing, HSTS, …) for everything this listener serves.
# Every location below that adds a header of its own includes the file again —
# see the note at the top of it.
include /etc/nginx/webmail-security.conf;
# ---- API ----------------------------------------------------------------
location /api/ {
@@ -72,12 +71,14 @@ location ~ ^/\.well-known/(caldav|carddav)$ {
location /assets/ {
expires 1y;
add_header Cache-Control "public, immutable";
include /etc/nginx/webmail-security.conf;
try_files $uri =404;
}
location /fonts/ {
expires 30d;
add_header Cache-Control "public";
include /etc/nginx/webmail-security.conf;
try_files $uri =404;
}
@@ -85,6 +86,7 @@ location = /healthz {
access_log off;
return 200 "ok\n";
add_header Content-Type text/plain;
include /etc/nginx/webmail-security.conf;
}
# The SPA fallback lives in each server block, not here: the two listeners serve
@@ -95,12 +97,14 @@ location = /healthz {
# because the public listener 404s /admin.html before it can be served.
location = /index.html {
add_header Cache-Control "no-store, must-revalidate";
include /etc/nginx/webmail-security.conf;
}
# The offline-access service worker (frontend/public/sw.js): a fixed URL the
# browser re-checks for a new version, so it must not be cached either.
location = /sw.js {
add_header Cache-Control "no-cache";
include /etc/nginx/webmail-security.conf;
try_files $uri =404;
}
@@ -110,5 +114,6 @@ location = /manifest.webmanifest {
default_type application/manifest+json;
types { }
add_header Cache-Control "no-cache";
include /etc/nginx/webmail-security.conf;
try_files $uri =404;
}
docker/nginx-security.conf
+31
View File
@@ -0,0 +1,31 @@
# Security headers for every response of the front door — the app shell, the
# static files and the API alike.
#
# Included at server level by nginx-app.conf AND inside every location that
# adds a header of its own: nginx drops ALL inherited add_header lines in a
# location that has any add_header, which is how index.html once went out with
# only its Cache-Control (security report, finding 1). A new location with an
# add_header must include this file too.
#
# Content-Security-Policy, by directive:
# script-src 'self' the Vite bundles, plugin bundles (/api/plugins/…) and
# workers are all same-origin; no inline script, no eval
# (pdf.js is told not to try).
# style-src 'unsafe-inline': React and the plugins set style
# attributes, and message HTML carries its own <style>.
# img-src / font-src https:/http: because an email whose images the user
# chose to load fetches them from the sender's servers
# (the message frame is srcdoc, so it shares this policy).
# connect-src the API and the live-update WebSocket on this host
# ($http_host: with the port, for LAN access on WEB_PORT).
# frame-ancestors 'self', not 'none': printing an attachment loads it in
# a hidden frame of our own. No other site may frame us.
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https: http:; font-src 'self' data: https:; media-src 'self' blob:; connect-src 'self' wss://$http_host ws://$http_host; worker-src 'self' blob:; frame-src 'self' blob:; manifest-src 'self'; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'self'" always;
add_header X-Frame-Options SAMEORIGIN always;
add_header X-Content-Type-Options nosniff always;
add_header Referrer-Policy no-referrer always;
add_header Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=(), usb=()" always;
# Only on requests that reached the reverse proxy over HTTPS ($hsts is empty
# otherwise, and nginx sends no header with an empty value): plain-HTTP LAN
# access on WEB_PORT keeps working.
add_header Strict-Transport-Security $hsts always;
docker/nginx.conf
+17
View File
@@ -28,6 +28,15 @@ map $http_x_forwarded_proto $fwd_proto {
http http;
}
# HSTS only for requests that came in over HTTPS (nginx-security.conf).
map $fwd_proto $hsts {
https "max-age=31536000";
default "";
}
# No nginx version in the Server header or on error pages.
server_tokens off;
# Connection header for the WebSocket upgrade dance on /api/ws.
map $http_upgrade $connection_upgrade {
default upgrade;
@@ -44,6 +53,13 @@ server {
listen 80;
server_name _;
# The reverse proxy in front (DSM) terminates TLS and says how the browser
# came in. Plain HTTP from the internet goes to HTTPS; a request with no
# such header (LAN access straight to WEB_PORT) is left alone.
if ($http_x_forwarded_proto = "http") {
return 301 https://$host$request_uri;
}
# Regex locations beat prefix ones, so this wins over `location /api/`
# regardless of order. `(/|$)` keeps it to /api/admin and /api/admin/...,
# never a future /api/administrators. 404 rather than 403: a port open to
@@ -76,6 +92,7 @@ server {
location = /admin.html {
add_header Cache-Control "no-store, must-revalidate";
include /etc/nginx/webmail-security.conf;
}
# SPA fallback -> the admin panel. `/` on this port IS the panel; the mail