security: Tighten CSP to remove unsafe-inline for styles

[Xhristin3]

Problem Statement

The Helmet CSP in api/src/main.ts:25 permits 'unsafe-inline' for styles to support Swagger UI. This weakens the Content Security Policy globally for all API responses, including non-Swagger routes.

Evidence

styleSrc: ["'self'", "'unsafe-inline'"],

Impact

XSS attacks that inject <style> tags or use inline style attributes may bypass CSP. The unsafe-inline directive weakens the primary defense against CSS injection attacks.

Proposed Solution

1. Serve Swagger UI under /docs with a separate, relaxed CSP (using a route-specific middleware or helmet.route-specific config)
2. Remove 'unsafe-inline' from the global CSP
3. Add nonce-based inline style support if needed

Acceptance Criteria

• Global CSP does not include 'unsafe-inline'
• Swagger UI at /docs still renders correctly
• Swagger-specific CSP allows required styles

File Map

• api/src/main.ts — tighten global CSP
• api/src/swagger-csp.middleware.ts — new relaxed CSP for /docs

---

Labels: security
Priority: Low | Difficulty: Intermediate | Estimated Effort: 1d

---

Labels: security
Priority: Low | Difficulty: Intermediate | Estimated Effort: 1d
Backlog ID: REPO-040

[samieazubike]

Hi maintainer! Kindly assign the issue to me. I can create a PR within 12hr

[clintjeff2]

Hello, I have 6 years of experience working on tasks like this and handling similar challenges across backend, frontend, and smart-contract development. I have carefully read and fully understood the task requirements, and I am confident I can deliver a clean, efficient, and well-tested solution promptly. I always ensure high-quality implementation, maintainability, and adherence to best practices.

Pull request in 10 hours

[Agbasimere]

Hi there, I'd like to work on this issue.

[grantfox-oss]

🦊 GrantFox — @samieazubike has been assigned to this issue as part of the Official Campaign campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #223)
2. Your PR will be reviewed by the XStreamRollz maintainers

Good luck! Track your progress on GrantFox.