Add Content Security Policy (CSP) to enhance security

[usernayeem]

Description

This pull request introduces a Content Security Policy (CSP) to the devFind application. The CSP is designed to enhance the security of the application by restricting the sources from which content can be loaded. This helps to reduce the risk of cross-site scripting (XSS) and other injection attacks.

Related Issues

#1117

Changes Proposed

• Added a CSP meta tag to the main HTML file with the following directives:
  • default-src 'none';: Disallows all content by default.
  • script-src 'self' 'unsafe-inline';: Allows scripts only from the same origin and inline scripts.
  • style-src 'self' 'unsafe-inline' https://fonts.googleapis.com;: Permits styles from the same origin, inline styles, and Google Fonts.
  • font-src 'self' https://fonts.gstatic.com;: Restricts font loading to the same origin and Google Fonts.
  • img-src 'self' https://github.com/ https://avatars.githubusercontent.com/ https://pbs.twimg.com;: Allows images from the same origin, GitHub, and Twitter.
  • manifest-src 'self';: Restricts the web app manifest to the same origin.
  • connect-src 'self';: Limits network connections to the same origin.
  • base-uri 'self';: Ensures that the base URL is restricted to the same origin.
  • form-action 'self';: Restricts form submissions to the same origin.

Checklist

• I have read and followed the Contribution Guidelines.
• All new and existing tests passed.
• I have updated the documentation to reflect the changes I've made.
• My code follows the code style of this project.
• The title of my pull request is a short description of the requested changes.

Screenshots

Note to reviewers

Please review the CSP configuration to ensure it does not inadvertently block legitimate content. Testing across various environments is recommended to verify that all functionality remains intact while enhancing security.

[vercel]

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name	Status	Preview	Comments	Updated (UTC)
dev-find	✅ Ready (Inspect)	Visit Preview	💬 Add feedback	Aug 31, 2024 10:02am

[github-actions]

Great job, @usernayeem! 🎉 Thank you for opening a pull request. Your contribution is valuable and we appreciate your efforts to improve our project.

Soon the maintainers/owner will review it and provide you with feedback/suggestions.