🚀 Feature: hardened CSP headers #58

New Issue

OVERLORD · 2025-10-09T16:23:59+03:00

OVERLORD commented

2025-10-09 16:23:59 +03:00

Originally created by @lordraiden on GitHub.

Feature Description

Add a new section to the Pocket-ID documentation that provides a recommended Content Security Policy (CSP) header configuration for the Pocket-ID login page. This policy will provide a layer of protection against client-side attacks like Cross-Site Scripting (XSS) and data injection. The documentation should explain each directive in the policy and how it contributes to security.
The documentation should recommend a basic, secure CSP header that can be easily implemented by users running Pocket-ID behind a reverse proxy. This is a common setup in homelabs.

### Pitch

This feature request is about defense in depth. While Pocket-ID's core functionality is secure, the login page itself is a potential attack vector. A well-defined CSP adds a critical layer of protection by instructing the user's browser to only load resources from trusted sources.

This is a low-effort, high-reward change. It doesn't require any changes to the Pocket-ID codebase itself. The recommended policy can be added to the documentation, allowing users to configure it on their own reverse proxy (like Nginx, Caddy, or Traefik). By following the example of projects like Authentik, Pocket-ID can provide its users with the tools they need to harden their own self-hosted environments.

Originally created by @lordraiden on GitHub. ### Feature Description Add a new section to the Pocket-ID documentation that provides a recommended Content Security Policy (CSP) header configuration for the Pocket-ID login page. This policy will provide a layer of protection against client-side attacks like Cross-Site Scripting (XSS) and data injection. The documentation should explain each directive in the policy and how it contributes to security. The documentation should recommend a basic, secure CSP header that can be easily implemented by users running Pocket-ID behind a reverse proxy. This is a common setup in homelabs. ### Pitch This feature request is about defense in depth. While Pocket-ID's core functionality is secure, the login page itself is a potential attack vector. A well-defined CSP adds a critical layer of protection by instructing the user's browser to only load resources from trusted sources. This is a low-effort, high-reward change. It doesn't require any changes to the Pocket-ID codebase itself. The recommended policy can be added to the documentation, allowing users to configure it on their own reverse proxy (like Nginx, Caddy, or Traefik). By following the example of projects like Authentik, Pocket-ID can provide its users with the tools they need to harden their own self-hosted environments.

OVERLORD closed this issue

2025-10-09 16:24:00 +03:00

OVERLORD commented

2025-10-09 16:24:03 +03:00

@stonith404 commented on GitHub:

I believe it would be a good idea to add a default CSP header to Pocket ID. If users want to harden the header further by overriding it, they can do so on their reverse proxy. However, I don't think we need to document this, as a CSP header applies to all applications and is not specific to Pocket ID. Do you agree?

@stonith404 commented on GitHub: I believe it would be a good idea to add a default CSP header to Pocket ID. If users want to harden the header further by overriding it, they can do so on their reverse proxy. However, I don't think we need to document this, as a CSP header applies to all applications and is not specific to Pocket ID. Do you agree?

OVERLORD referenced this issue

2025-10-09 16:59:23 +03:00

[PR #244] [MERGED] feat: add ability to upload a profile picture #901

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/pocket-id-pocket-id-2#58