Skip to main content

Boundary Hardening

Lock transport and cross-origin surfaces; prevent data bleed.

C
Written by Catalin Fetean
Updated over 2 weeks ago

Audience: Infra/SRE/Security, Frontend
​Outcomes: Downgrade-proof TLS, strict origins, no script abuse

TLS & HSTS

import helmet from 'helmet'; app.use(helmet.hsts({ maxAge:31536000, includeSubDomains:true, preload:true })); // TLS 1.2+

CORS (allowlist + credentials)

const allowed = ['https://app.example.com','https://dashboard.example.com']; app.use((req,res,next)=>{ const o = req.header('Origin')||''; if(allowed.includes(o)){ res.header('Access-Control-Allow-Origin', o); res.header('Access-Control-Allow-Credentials', 'true'); res.header('Vary','Origin'); } next(); });

CSP (Helmet)

app.use(helmet.contentSecurityPolicy({ directives:{ defaultSrc:["'self'"], scriptSrc:["'self'","https://js.stripe.com"], connectSrc:["'self'","https://api.stripe.com"], frameSrc:["'self'","https://checkout.stripe.com"], imgSrc:["'self'","data:"], objectSrc:["'none'"], baseUri:["'self'"], frameAncestors:["'none'"] } }));

Isolation

  • Every DB query includes orgId predicate.

  • Cross-org actions require partner link + consent.

QA checklist

  • No wildcard CORS with credentials.

  • CSP Report-Only passes → then enforce.

  • Attempt to fetch foreign org resource returns 403.

Runbook: CSP breaks UI

  1. Switch to Report-Only;

  2. Inspect violations;

  3. Add the minimal domains;

  4. Re-enable enforcement.

Did this answer your question?