Security Headers

Claw GRC configures comprehensive HTTP security headers across all services for defense in depth against common web attacks.

Content Security Policy (CSP)

The Content Security Policy restricts which resources the browser can load, preventing cross-site scripting (XSS) and data injection attacks.

Content-Security-Policy:
  default-src 'self';
  script-src 'self' https://apis.google.com https://www.gstatic.com https://js.stripe.com;
  style-src 'self' 'unsafe-inline';
  img-src 'self' data: https:;
  font-src 'self' https://fonts.gstatic.com;
  connect-src 'self' https://*.firebaseio.com https://*.googleapis.com wss://*.firebaseio.com https://api.stripe.com;
  frame-src https://*.firebaseapp.com https://js.stripe.com;
  object-src 'none';
  base-uri 'self';

Key Decisions

• No 'strict-dynamic' -- The Next.js frontend uses external <script src="/_next/..."> tags, not inline scripts. 'strict-dynamic' would cause browsers to ignore 'self', breaking the page.
• No 'unsafe-eval' -- Eval is not used anywhere in the frontend.
• 'unsafe-inline' for styles only -- Required for CSS-in-JS frameworks. Script inline execution is blocked.
• Explicit CDN allowlists -- Firebase, Google APIs, and Stripe are the only external script sources.

HTTP Strict Transport Security (HSTS)

Forces browsers to use HTTPS for all future requests:

Strict-Transport-Security: max-age=63072000; includeSubDomains; preload

• max-age=63072000 -- 2 years
• includeSubDomains -- Applies to all subdomains
• preload -- Eligible for browser HSTS preload lists

X-Frame-Options

Prevents the application from being embedded in iframes (clickjacking protection):

X-Frame-Options: DENY

X-Content-Type-Options

Prevents MIME-type sniffing:

X-Content-Type-Options: nosniff

Referrer-Policy

Controls how much referrer information is sent with requests:

Referrer-Policy: strict-origin-when-cross-origin

Same-origin requests include the full URL; cross-origin requests include only the origin.

Permissions-Policy

Restricts access to browser features:

Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=(self)

All features are disabled except payment (required for Stripe integration).

CORS

Cross-Origin Resource Sharing is configured on the API Gateway:

Header	Value
Access-Control-Allow-Origin	https://app.clawgrc.com (production)
Access-Control-Allow-Methods	GET, POST, PUT, DELETE, OPTIONS
Access-Control-Allow-Headers	Authorization, Content-Type, X-API-Key
Access-Control-Max-Age	86400 (24 hours)

In development mode, the origin is set to http://localhost:3000.

API Gateway Headers

The API Gateway adds security headers to all proxied responses:

Header	Purpose
X-Request-ID	Unique request identifier for tracing
X-RateLimit-*	Rate limiting information
Cache-Control: no-store	Prevent caching of API responses

Internal Header Security

The API Gateway strips all internal headers from incoming requests before setting them from the authenticated context:

• X-Org-ID -- Stripped and set from JWT/API key claims
• X-Actor-ID -- Stripped and set from JWT/API key claims
• X-Actor-Type -- Stripped and set from JWT/API key claims
• X-Actor-Role -- Stripped and set from JWT/API key claims
• X-Actor-Email -- Stripped and set from JWT claims
• X-Gateway-Secret -- Set by the gateway for backend service verification

This prevents header injection attacks where a malicious client could forge tenant context headers.

Compliance Coverage

Framework	Control	Header
SOC 2 CC6.7	Restrict data transmission	HSTS, CSP
ISO 27001 A.14.1.2	Secure application services	All headers
NIST 800-53 SC-8	Transmission confidentiality	HSTS
NIST 800-53 SI-3	Malicious code protection	CSP
PCI DSS 6.4.1	Web application protection	CSP, X-Frame-Options
OWASP Top 10	Cross-site scripting	CSP
OWASP Top 10	Clickjacking	X-Frame-Options