Complete static-site migration: _headers/_redirects for 18 frontends - #1470
Merged
Conversation
The frontends moved to the @dfinity/static-site (certified-assets) recipe but kept their legacy .ic-assets.json5 configs, which certified-assets ignores — so their security headers were silently dropped and SPA fallback was gone. Replace them per the static-site skill: - Delete the 18 dead .ic-assets.json5 files. - Add frontend/public/_headers: each example's CSP ported verbatim, plus the skill's baseline hardening (X-Frame-Options, X-Content-Type-Options, Referrer-Policy) and caching (immutable assets, revalidated HTML). - Add frontend/public/_redirects with the SPA fallback /* /index.html 200. - Examples that only had a security_policy preset or X-Frame-Options and no explicit CSP (ic-pos, basic_vetkd) get the hardening headers only — no invented CSP, since a default-src 'self' would break ledger/II calls. - image-classification: its .ic-assets.json5 sat in frontend/assets/ (not the Vite publicDir), so it never reached dist even on the legacy recipe; new files go in a real frontend/public/ so its CSP is now effective. - AGENTS.md: document the _headers/_redirects convention. Verified locally (encrypted_notes + image-classification): headers land and are certified, SPA deep-link reload returns the shell. Part of #1458.
lwshang
approved these changes
Aug 6, 2026
pierugo-dfinity
approved these changes
Aug 6, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #1460 (part of #1458). The frontends run on
@dfinity/static-site(certified-assets) but still carried legacy.ic-assets.json5configs, which that canister ignores — so their security headers were silently lost and SPA fallback was gone. This ports each one to_headers+_redirectsper thestatic-siteskill.What changed (18 examples)
.ic-assets.json5.frontend/public/_headers: each example's CSP ported verbatim (they differ — some need'unsafe-eval', differentconnect-src), plus the skill's baseline hardening + caching.frontend/public/_redirects:/* /index.html 200SPA fallback.ic-posandbasic_vetkdhad only a preset /X-Frame-Optionsand no explicit CSP → hardening headers only, no invented CSP (adefault-src 'self'would break ic-pos's ledger/II calls).image-classification: its.ic-assets.json5was infrontend/assets/(not the Vitepublic/dir), so it almost certainly never reacheddisteven on the legacy recipe — its CSP was dead. New files go in a realfrontend/public/, making its CSP effective for the first time.Verified locally (encrypted_notes + image-classification): the CSP and hardening headers land and are certified (they appear in the canister's
ic-certificateExpression), and a deep-link reload (/deep/route) returns the shell with200 text/html.Changes vs the old asset-canister
security_policydefaultThe baseline follows the
static-siteskill, which is not a byte-for-byte match of the legacysecurity_policy(defined here):security_policyDENYDENY(same)nosniffnosniff(same)same-originstrict-origin-when-cross-origin(changed)max-age=31536000; includeSubDomainsHSTS is dropped deliberately:
_headersalso apply in local dev, and a canister-servedStrict-Transport-Securitywould force HTTPS onhttp://…localhostand break local development.Question for the reviewer
Is this delta acceptable, or should the
static-siteskill handle migrations more explicitly? Concretely: could an app that migrates by following the current skill be harmed by silently losing HSTS or having itsReferrer-Policychange fromsame-origintostrict-origin-when-cross-origin— and if so, should the skill's migration guide call these deltas out (or offer an HSTS variant for custom-domain apps)?Out of scope
photo-storage(hosting/photo-storage broken on static-site recipe — revert to asset-canister interim, decide long-term fate #1459, deliberately on the legacy asset-canister recipe).unity_ii_deeplink.well-knowninstructions (unity_ii_deeplink: .well-known instructions invalid on static-site (certified-assets) #1461).🤖 Generated with Claude Code