dashboard: a content security policy, framed by none

Review finding 12, browsers: the dashboard holds a bearer token in
memory and edits the document, but had no content security policy and
could be framed by any page of the same site (another port on the same
host, anything sharing a domain behind a proxy), acting with its user's
token.

The dashboard and the login page now come with a policy that runs only
their own inline script (by its hash, computed when first served),
loads nothing from elsewhere, and lets no page frame them
(frame-ancestors 'none', X-Frame-Options DENY). Fetches stay open to
any origin, as the members' dashboards are wherever the member list
says.

The browser check (check.js) loads the page from a file, without the
header, so the policy wants one look in a browser.

1 files changed, 2 insertions, 1 deletions

diff --git a/docs/dashboard.md b/docs/dashboard.md
index 01507df..db599fb 100644
--- a/docs/dashboard.md
+++ b/docs/dashboard.md
@@ -21,7 +21,8 @@ dashboard without one is sent to. There, a user logs in with its password
 [`access.md`](access.md), Tokens), or any other. The page keeps a session for the
 browser, a cookie no script reads and no other site's page sends, renewed while the
 dashboard is open; it ends with the token's lifetime, or with "Log out of this
-browser". The API listens on localhost unless `--bind-addr` says otherwise;
+browser". The page and the login page run their own script only (a content security
+policy naming it by its hash), and no other page may frame them. The API listens on localhost unless `--bind-addr` says otherwise;
 to look at a node on another machine, forward the port (`ssh -L 3000:localhost:3000
 <machine>`) or put a TLS proxy in front ([`operations.md`](operations.md), Behind a reverse proxy).