On lab--forge-trevato-apps, /__forge/ carries CSP, Referrer-Policy and nosniff, but /__forge/crew, /__forge/notes and POST /__forge/note answer JSON with only cache-control and x-content-type-options. The json helper in src/apps/feedback.ts and the crew answer in src/apps/proxy.ts skip securityFloor.
Done when:
[ ] Every response under /__forge/ (door, crew, notes, note, and their errors and 404s) passes through securityFloor in src/apps/proxy.ts, or gets the same headers: content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none' for JSON, plus referrer-policy and x-content-type-options.
[ ] One test walks each /__forge/* path, GET and POST, signed in and out, and asserts the three headers on every answer. Removing the floor from any one of them fails it.
[ ] The pill still works, because its fetches are same-origin and unaffected by CSP on the JSON.
On lab--forge-trevato-apps,
/__forge/carries CSP, Referrer-Policy and nosniff, but/__forge/crew,/__forge/notesandPOST /__forge/noteanswer JSON with onlycache-controlandx-content-type-options. Thejsonhelper in src/apps/feedback.ts and the crew answer in src/apps/proxy.ts skipsecurityFloor.Done when:
/__forge/(door, crew, notes, note, and their errors and 404s) passes throughsecurityFloorin src/apps/proxy.ts, or gets the same headers:content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none'for JSON, plusreferrer-policyandx-content-type-options./__forge/*path, GET and POST, signed in and out, and asserts the three headers on every answer. Removing the floor from any one of them fails it.