From 49 to 87: an enforced CSP, caching and image fixes on a React SPA, without breaking production
· 15 min read
A security scanner gave our student site 49/100, "Critical CSP gaps". There was no Content-Security-Policy at all, the favicon alone weighed 601 KB, and nobody had looked at how the frontends were cached or compressed.
The stack: three React + Vite single-page apps (students, teachers, admins), each served by nginx in a container, behind a host nginx and Cloudflare, talking to FastAPI backends. Two environments, dev and prod, on two VPSs.