Primary miniBB scripts for CSP

Hello,

Could you tell me which scripts on your forum are primary scripts?

If I recall correctly, there are only two.

For 2 websites, I want to differentiate the CSP parameters for `script-src` and `style-src`:
on the main site: `self` with a nonce;
on the forum: `unsafe-inline`.

This requires me to declare a different header (Content-Security-Policy...) for the primary scripts.

I hope that makes sense.

I suppose, you mean javascripts?

If so, they are all located under the /templates/ folder, and in default version they are form.js and common.js.

For the file-upload related add-ons, there is also addon_filecheck.js.

If by "CSP parameters" you mean Content Security Policy (Web Security), then I'd recommend to modify the web server's configuration (for example, .htaccess or httpd.conf for Apache or nginx.conf for Nginx), and not inject the directives directly into your HTML files inside the <head> section, adding HTML Meta Tag.

As far as I remember, miniBB javascript codes are strictly tied up with the default HTML layout, and it is unpredictable if they would work with such directives or not. I cannot guarantee it and provide any kind of support in this case.

Hello Paul,

No, i mean primary PHP scripts.

Where to put header directives (for CSP).

Is it clear ?

Then it's not clear.

The primary PHP scripts are just index.php and bb_admin.php (or whatever it could be named).

But why would you need CSP for them?

It's naturally not possible to execute these scripts other than from the original domain.

Hello Paul,

There's a main website, and the forum is in a folder called `bb`.

In the `.htaccess` file, there's a `Header always set Content-Security-Policy` directive: `"default-src 'none'; connect-src 'self'; frame-ancestors 'none'; base-uri 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline', etc..."`.

On the main website, `script-src` and `style-src` will be secured with a nonce, so `unsafe-inline` won't be used.

On the forum, because there are small pieces of JavaScript scattered throughout and inline CSS within the HTML (this isn't a criticism), it's impossible to use a nonce, and we have to keep `unsafe-inline`.

This separation is impossible in the `.htaccess` file.

The solution suggested by the Gemini AI is to remove this directive from the .htaccess file and place it in the primary PHP scripts.

In index.php and bb_admin.php:
Header (Content-Security-Policy: "default-src 'none'; connect-src 'self'; frame-ancestors 'none'; base-uri 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline', etc..."

In the primary scripts of the main site:
Header (Content-Security-Policy: "default-src 'none'; connect-src 'self'; frame-ancestors 'none'; base-uri 'self'; script-src 'self' 'nonce ???'; style-src 'self' 'nonce: ????', etc...")

Do you agree?

I think you can use a different .htaccess in your /bb/ folder and then put the header with 'unsafe-inline' only in that folder's .htaccess, without adding a header to index.php or bb_admin.php.

I don't understand what purpose this all is for, that's why I couldn't give any comment until it's clear.

On your side, you must just understand what this all is for exactly on your website.

CSP is not a replacement for secure coding, so if you feel there is some leak in miniBB code, then it's a must to fix it at first and not just to slap CSP header on it.

Alternatively, you can try to set CSP in report-only mode and log any possible violations to check if you really need this.

Without understanding what you're doing it's quite easy to block your website from generic access.

Also, for me this all seems like a kids alarm preventing only obviously straight insecure cases. Professional hackers do not use regular browsers. The tools they use could bypass any headers.

Hello Paul,

I am no security expert—far from it.

I simply use the CSP recommended by testing tools, Google, and the like.

I am not questioning the security of your forum.

I've noted that there are just two primary scripts.
I'll insert the CSP directive there and keep you posted.

This is what I was about. Do not modify scripts if you don't understand the nature of changes. That's the only thing I could recommend.

I know it's nowadays sort of fashion to rely on solutions and "advices" thrown by machine algorithms, and in many cases they are useful — but not always, the crap's given often is not even close to that.

Hello Paul,

I don't find bb_admin.php in my very old version.

What is the name in old versions ?

name with "admin", I have only : mf2pqcm_admin.php

Hello Paul,

Ok but what do you think about HTTP Observatory ?

They recommend to have a good CSP header.

script-src 'self' 'unsafe-inline';

It works but it's not very strong.

Better is ;

script-src 'self'; script-src-elem 'self' 'unsafe-inline';

I'll test it in the .htaccess.

Instead of touching the .htaccess or PHP files, you can play to put something like this in the main_header.html's forum template:

It's not about the version, but the security. As recommended, you have obviously renamed your admin file and its filename is stored in setup_options.php -> $bb_admin setting.

If you mean the MDN tool, there miniBB website passes more tests than Google 😃 As many other services it's just a private service which gives its own recommendations. While not being associated with it, I couldn't give any comment.

Obviously it all could make sense if there's a way to make certain tests after it, making sure it all could some way protect your webiste from something exact.

This is what I wouldn't recommend initially. I didn't try it on my own and not sure all javascript codes would work properly with this tag afterall.

Hello Paul and tom322,

Right. It is possible to do it this way.

Yes, I mean the MDN tool.
And I know that minibb is very secure.

As a guest can I edit last post ?
I don't see how to do it.