From 276fe235ba0d21c3be700ccb3bebd531775f901f Mon Sep 17 00:00:00 2001
From: Ravi Lodhi <ravi.lodhi@hotwaxsystems.com>
Date: Wed, 20 Nov 2024 10:59:20 +0530
Subject: [PATCH 1/2] Improved: Added X-Frame-Options, CSP,
 strict-transport-security and Permissions-Policy headers in firebase config
 in context of soc2 compliance (#104).

---
 firebase.json | 61 +++++++++++++++++++++++++++++++++++++++++++++++----
 1 file changed, 57 insertions(+), 4 deletions(-)

diff --git a/firebase.json b/firebase.json
index 0ad66623..b7c2d0fe 100644
--- a/firebase.json
+++ b/firebase.json
@@ -11,8 +11,25 @@
       "rewrites": [ {
         "source": "**",
         "destination": "/index.html"
-      } ]
-
+      } ],
+      "headers": [ {
+        "source": "**",
+        "headers": [ {
+          "key": "X-Frame-Options",
+          "value": "SAMEORIGIN"
+        },
+        {
+          "key": "Content-Security-Policy",
+          "value": "default-src 'self';font-src 'self' data: *;script-src 'self' 'unsafe-inline' 'unsafe-eval' fonts.googleapis.com;img-src 'self' 'unsafe-inline' *.shopify.com javascript: ;style-src 'self' 'unsafe-inline' *; connect-src 'self' *"
+        },
+        {
+          "key": "strict-transport-security",
+          "value": "max-age=31536000; includeSubDomains"
+        },{
+          "key": "Permissions-Policy",
+          "value": "camera=self"
+        } ]
+      }]
     },
     {
       "target": "dev",
@@ -25,7 +42,25 @@
       "rewrites": [ {
         "source": "**",
         "destination": "/index.html"
-      } ]
+      } ],
+      "headers": [ {
+        "source": "**",
+        "headers": [ {
+          "key": "X-Frame-Options",
+          "value": "SAMEORIGIN"
+        },
+        {
+          "key": "Content-Security-Policy",
+          "value": "default-src 'self';font-src 'self' data: *;script-src 'self' 'unsafe-inline' 'unsafe-eval' fonts.googleapis.com;img-src 'self' 'unsafe-inline' *.shopify.com javascript: ;style-src 'self' 'unsafe-inline' *; connect-src 'self' *"
+        },
+        {
+          "key": "strict-transport-security",
+          "value": "max-age=31536000; includeSubDomains"
+        },{
+          "key": "Permissions-Policy",
+          "value": "camera=self"
+        } ]
+      }]
     },
     {
       "target": "uat",
@@ -38,7 +73,25 @@
       "rewrites": [ {
         "source": "**",
         "destination": "/index.html"
-      } ]
+      } ],
+      "headers": [ {
+        "source": "**",
+        "headers": [ {
+          "key": "X-Frame-Options",
+          "value": "SAMEORIGIN"
+        },
+        {
+          "key": "Content-Security-Policy",
+          "value": "default-src 'self';font-src 'self' data: *;script-src 'self' 'unsafe-inline' 'unsafe-eval' fonts.googleapis.com;img-src 'self' 'unsafe-inline' *.shopify.com javascript: ;style-src 'self' 'unsafe-inline' *; connect-src 'self' *"
+        },
+        {
+          "key": "strict-transport-security",
+          "value": "max-age=31536000; includeSubDomains"
+        },{
+          "key": "Permissions-Policy",
+          "value": "camera=self"
+        } ]
+      }]
     }
   ]
 }

From f3c3fd169370f6245b6d4b2feb88183345c37001 Mon Sep 17 00:00:00 2001
From: Ravi Lodhi <ravi.lodhi@hotwaxsystems.com>
Date: Fri, 22 Nov 2024 11:41:57 +0530
Subject: [PATCH 2/2] Fixed: Updated security policy header to allow loading
 scripts related to FCM (#104).

---
 firebase.json | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/firebase.json b/firebase.json
index b7c2d0fe..d2c72f29 100644
--- a/firebase.json
+++ b/firebase.json
@@ -20,7 +20,7 @@
         },
         {
           "key": "Content-Security-Policy",
-          "value": "default-src 'self';font-src 'self' data: *;script-src 'self' 'unsafe-inline' 'unsafe-eval' fonts.googleapis.com;img-src 'self' 'unsafe-inline' *.shopify.com javascript: ;style-src 'self' 'unsafe-inline' *; connect-src 'self' *"
+          "value": "default-src 'self';font-src 'self' data: *;script-src 'self' 'unsafe-inline' 'unsafe-eval' fonts.googleapis.com https://www.gstatic.com;img-src 'self' 'unsafe-inline' *.shopify.com javascript: ;style-src 'self' 'unsafe-inline' *;connect-src 'self' *"
         },
         {
           "key": "strict-transport-security",
@@ -51,7 +51,7 @@
         },
         {
           "key": "Content-Security-Policy",
-          "value": "default-src 'self';font-src 'self' data: *;script-src 'self' 'unsafe-inline' 'unsafe-eval' fonts.googleapis.com;img-src 'self' 'unsafe-inline' *.shopify.com javascript: ;style-src 'self' 'unsafe-inline' *; connect-src 'self' *"
+          "value": "default-src 'self';font-src 'self' data: *;script-src 'self' 'unsafe-inline' 'unsafe-eval' fonts.googleapis.com https://www.gstatic.com;img-src 'self' 'unsafe-inline' *.shopify.com javascript: ;style-src 'self' 'unsafe-inline' *;connect-src 'self' *"
         },
         {
           "key": "strict-transport-security",
@@ -82,7 +82,7 @@
         },
         {
           "key": "Content-Security-Policy",
-          "value": "default-src 'self';font-src 'self' data: *;script-src 'self' 'unsafe-inline' 'unsafe-eval' fonts.googleapis.com;img-src 'self' 'unsafe-inline' *.shopify.com javascript: ;style-src 'self' 'unsafe-inline' *; connect-src 'self' *"
+          "value": "default-src 'self';font-src 'self' data: *;script-src 'self' 'unsafe-inline' 'unsafe-eval' fonts.googleapis.com https://www.gstatic.com;img-src 'self' 'unsafe-inline' *.shopify.com javascript: ;style-src 'self' 'unsafe-inline' *;connect-src 'self' *"
         },
         {
           "key": "strict-transport-security",