From 35a57e5fa7ccbaa735cb3f684993b313cb465792 Mon Sep 17 00:00:00 2001
From: SaelixCode <dev@saelix.com>
Date: Sun, 22 Mar 2026 19:41:13 -0400
Subject: [PATCH] fix(security): disable COOP header and Vite module-preload
 polyfill
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Two console errors on HTTP deployments with no functional impact:

1. Helmet's default Cross-Origin-Opener-Policy: same-origin is ignored
   by browsers over HTTP but logged as a console error. Disabled via
   crossOriginOpenerPolicy: false (same rationale as HSTS/COEP).

2. Vite's production build injects an inline module-preload polyfill
   script blocked by script-src 'self'. Disabled via
   build.modulePreload.polyfill: false — all modern browsers support
   link rel="modulepreload" natively.
---
 CHANGELOG.md            | 2 ++
 backend/src/index.ts    | 3 +++
 frontend/vite.config.ts | 7 +++++++
 3 files changed, 12 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 06d8dd49..bb84e5c7 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [Unreleased]
 
 ### Fixed
+- **COOP header console warning on HTTP deployments:** Helmet sends `Cross-Origin-Opener-Policy: same-origin` by default, which browsers silently ignore over HTTP but log as a console error. Disabled via `crossOriginOpenerPolicy: false` — same rationale as the existing HSTS and COEP disables.
+- **Inline script CSP violation from Vite module-preload polyfill:** Vite's production build injects a small inline `<script>` for the module-preload polyfill that was blocked by `script-src 'self'`. Disabled via `build.modulePreload.polyfill: false` in `vite.config.ts` — all modern browsers support `<link rel="modulepreload">` natively.
 - **Blank page on HTTP deployments (root cause — Helmet 8 default CSP):** Helmet 8 merges custom `directives` with its built-in defaults, which include `upgrade-insecure-requests`. The previous fix (PR #59) omitted the directive from the custom object, but Helmet silently re-added it from defaults. The correct fix is `upgradeInsecureRequests: null`, which is the Helmet 8 API for explicitly removing a default directive.
 - **Login loop caused by remote node auth failure:** When a configured remote node had an expired or invalid API token, every proxied request to that node returned 401. Both `apiFetch` and `fetchForNode` treated any 401 as a user session failure and dispatched `sencho-unauthorized`, immediately logging the user out and sending them back to the login page — even after a successful login. Fixed by adding a `proxyRes` handler that stamps all remote-proxied responses with `x-sencho-proxy: 1`; the frontend now only fires `sencho-unauthorized` when this header is absent (i.e., it's a genuine local session failure).
 - **Missing `authMiddleware` on notifications endpoints:** `GET /api/notifications`, `POST /api/notifications/read`, `DELETE /api/notifications/:id`, `DELETE /api/notifications`, and `POST /api/notifications/test` were all missing `authMiddleware`, violating the default-deny policy. Added to all five.
diff --git a/backend/src/index.ts b/backend/src/index.ts
index 63cab8b9..de844985 100644
--- a/backend/src/index.ts
+++ b/backend/src/index.ts
@@ -76,6 +76,9 @@ const getCookieOptions = (req: Request) => ({
 //   Setting null is the Helmet 8 API to remove a default directive.
 app.use(helmet({
   crossOriginEmbedderPolicy: false,
+  // COOP is only meaningful over HTTPS. Over HTTP the browser logs a warning
+  // and ignores it, creating noise in the console with no security benefit.
+  crossOriginOpenerPolicy: false,
   hsts: false,
   contentSecurityPolicy: {
     directives: {
diff --git a/frontend/vite.config.ts b/frontend/vite.config.ts
index 5ea7361d..27884d82 100644
--- a/frontend/vite.config.ts
+++ b/frontend/vite.config.ts
@@ -11,6 +11,13 @@ export default defineConfig({
       "@": path.resolve(__dirname, "./src"),
     },
   },
+  build: {
+    // Disable the module-preload polyfill inline script.
+    // Vite injects a small inline <script> for module preloading that violates
+    // our CSP (script-src 'self' blocks all inline scripts). All modern browsers
+    // support <link rel="modulepreload"> natively, so the polyfill is unnecessary.
+    modulePreload: { polyfill: false },
+  },
   server: {
     proxy: {
       '/api': {