connect-src CSP directive is silently dropped from security headers

[adi2k5]

Lychee version

v 7.4.0

Did you check the latest Lychee version?

Yes, I did

Which PHP version are you using?

PHP 8.4

Detailed description of the problem

During troubleshooting some issues with my Lychee.org + matomo installation on my server, claude found possible bug in secure-headers.php. I allowed claude to prepare detailed report of the problem, and with possible fix.

The connect-src directive in config/secure-headers.php is built as a flat array instead of the nested ['allow' => [...]] structure expected by the bepsvpt/secure-headers library. As a result, the directive is silently omitted from the Content-Security-Policy response header entirely, regardless of what is set in SECURITY_HEADER_CSP_CONNECT_SRC in .env.

Steps to reproduce the issue

1. Set a value for SECURITY_HEADER_CSP_CONNECT_SRC in .env:

   SECURITY_HEADER_CSP_CONNECT_SRC=https://example.com
   

2. Clear and rebuild the config cache:

   php artisan config:clear
   php artisan config:cache

3. Inspect the Content-Security-Policy response header:

   curl -sI https://your-lychee-instance/ | grep content-security-policy

Expected Behaviour

The Content-Security-Policy header should contain:

connect-src 'self' https://lycheeorg.dev/update.json https://example.com

Actual Behaviour

The connect-src directive is completely absent from the header:

Content-Security-Policy: form-action 'self'; frame-ancestors 'none'; img-src ...

The directive is silently dropped because ContentSecurityPolicyBuilder::directives() skips any directive whose resolved value is an empty string. Since the config array has no recognized keys (self, allow, etc.), directive() returns '' and the
entry is skipped.

Root Cause

In config/secure-headers.php, connect-src is defined as:

'connect-src' => array_merge(
    ['https://lycheeorg.dev/update.json'],
    explode(',', (string) env('SECURITY_HEADER_CSP_CONNECT_SRC', ''))
),

This produces a flat indexed array, e.g.:

[
    0 => 'https://lycheeorg.dev/update.json',
    1 => 'https://example.com',
]

The bepsvpt/secure-headers library's ContentSecurityPolicyBuilder::directive() method looks for specific keys in the config array — most importantly allow for explicit URL sources, and boolean keys like self, unsafe-inline, etc. An indexed array has none of these keys, so the method returns an empty string and the directive is omitted.

Compare with other directives in the same file that work correctly, e.g. img-src:

'img-src' => [
    'allow' => array_merge(
        [...],
        explode(',', (string) env('SECURITY_HEADER_CSP_IMG_SRC', ''))
    ),
],

Proposed Fix

Wrap the array_merge call inside the allow key, consistent with how all other directives are defined in the same file:

'connect-src' => [
    'allow' => array_merge(
        ['https://lycheeorg.dev/update.json'],
        array_filter(explode(',', (string) env('SECURITY_HEADER_CSP_CONNECT_SRC', '')))
    ),
],

The additional array_filter() call prevents an empty string from being added to the allow list when SECURITY_HEADER_CSP_CONNECT_SRC is not set — the same pattern should ideally be applied to the other directives as well.

Security Impact

connect-src controls which URLs the browser is allowed to contact via fetch(), XMLHttpRequest, WebSockets, and EventSource. Without this directive, the browser falls back to default-src, which may be more permissive than intended, potentially weakening the Content Security Policy of every Lychee installation that relies on
SECURITY_HEADER_CSP_CONNECT_SRC.

Workaround

Edit config/secure-headers.php directly with the fix shown above, then run:

php artisan config:clear
php artisan config:cache

Diagnostics [REQUIRED]

n/a

Browser & System [REQUIRED]

n/a

Please confirm (incomplete submissions will not be addressed)

• I have provided easy and step-by-step instructions to reproduce the bug.
• I understand my bug report will be removed if I haven't met the criteria above.
• I understand that if I am requested to provide more information, I must do so within 14 days or the bug report will be closed.

[ildyria]

Can you check with version 7.4.1 that just got released ? I was literally working on the CSP today.

[ildyria]

I am creating a PR with your fix anyway, I will double check the resulting CSP and once it hits master, you can use the edge tag.

[ildyria]

BTW I like your detailed analysis. Very much appreciated.

[adi2k5]

Ok, so it seems that work has been done on different issues, after updating to 7.4.1 problem described above is still there:

# git describe --tags --abbrev=0
v7.4.1
# php artisan lychee:diagnostics | grep ^version
version:                                   070401
# curl -sI https://my.server | grep content-security-policy | sed 's/;/\n/g' |grep -i connect
# grep CSP_CONN .env 
SECURITY_HEADER_CSP_CONNECT_SRC=https://my.server

After manually applying changes again to secure-headers.php, the result is:

# curl -sI https://my.server | grep content-security-policy | sed 's/;/\n/g' |grep -i connect
content-security-policy: connect-src https://lycheeorg.dev/update.json https://my.server

[ildyria]

It will be in the next release or on the edge tag in about 1h (max).