67 lines
3.2 KiB
Markdown
67 lines
3.2 KiB
Markdown
# Privacy, security and deployment
|
|
|
|
## Data flow
|
|
|
|
Colour input, saved palette entries, selected image bytes, decoded pixels and
|
|
generated exports stay in the browser. The application does not issue API
|
|
requests, load remote fonts, submit analytics or resolve remote colour
|
|
references. A saved palette belongs to the current browser origin and is
|
|
stored until the user clears it or browser storage is removed. Images are
|
|
in-memory only.
|
|
|
|
The static host still receives ordinary requests for HTML, JavaScript, CSS,
|
|
icons and worker files on initial load and revalidation. Host logs, reverse
|
|
proxy logs and browser extension behaviour are outside the application's local
|
|
processing boundary.
|
|
|
|
DTCG documents and gradient recipes are parsed/generated in memory only. DTCG
|
|
references are restricted to the same pasted JSON document; no URI or remote
|
|
token resolver is used. Token/group depth, count and source size are bounded,
|
|
and cycles stop with diagnostics. Imported names/values and gradient CSS are
|
|
rendered as text or style values, never injected as HTML.
|
|
|
|
## Recommended headers
|
|
|
|
Serve the static artifact over HTTPS and apply a policy equivalent to:
|
|
|
|
```text
|
|
Content-Security-Policy: default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; form-action 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; connect-src 'self'; worker-src 'self' blob:; manifest-src 'self'
|
|
Cross-Origin-Opener-Policy: same-origin
|
|
Cross-Origin-Resource-Policy: same-origin
|
|
Permissions-Policy: camera=(), microphone=(), geolocation=(), usb=(), payment=()
|
|
Referrer-Policy: no-referrer
|
|
X-Content-Type-Options: nosniff
|
|
```
|
|
|
|
The shared Toolbox shell uses inline style properties for colour previews, so
|
|
`style-src 'unsafe-inline'` is currently required. Do not add
|
|
`script-src 'unsafe-inline'` or third-party script origins. `blob:` is required
|
|
for local image object URLs and may be used for a worker fallback.
|
|
|
|
Serve `.js` as `text/javascript`, `.json` as `application/json`, `.webmanifest`
|
|
as `application/manifest+json`, and `.svg` as `image/svg+xml`. Hashed assets may
|
|
use a long immutable cache lifetime; keep `index.html`, `sw.js` and
|
|
`toolbox-app.json` on revalidation/no-cache so releases update predictably.
|
|
|
|
## Reverse-proxy example
|
|
|
|
For an nginx deployment rooted at `/apps/colour/`, use `try_files` only to
|
|
resolve actual static files and the directory index; do not rewrite missing
|
|
asset paths to HTML. The application itself uses relative paths and needs no
|
|
server-side router. Keep the `sw.js` scope at the application directory.
|
|
|
|
If the app is assembled into toolbox-portal, use the portal's release lock and
|
|
assembly process instead of unpacking files into an existing live directory.
|
|
Verify the ZIP against its SHA-256 sidecar before assembly.
|
|
|
|
## File limits and cleanup
|
|
|
|
The image picker enforces encoded-byte, dimension and decoded-pixel limits
|
|
before expensive processing. Sampling radius and palette colour counts are
|
|
bounded. Object URLs, decoded buffers and worker requests are released or
|
|
cancelled when replaced. Browsers and image decoders remain security-sensitive
|
|
dependencies, so deploy current supported browser versions and publish patched
|
|
application releases promptly.
|
|
|
|
See [SECURITY.md](../SECURITY.md) for private reporting instructions.
|