#525 Harden the web platform's headers, embeds and analytics

[Anonymous]

Originally created by: athanclark

Closes [#504]. Refs [#521] (HSTS on the editor frame and embeds; hiding nginx's version is separate).

Security headers on every page:

• Every page by default: the platform's proxy now gives every response it serves the content security policy, frame-ancestors 'none', nosniff, Referrer-Policy: no-referrer, and HSTS over HTTPS.
• Why: before, pages had to be on a list, and /compare, /privacy, /terms and 404 pages weren't.
• Exceptions: the editor frame and embeds keep their own framing policies, and now send HSTS too (transportSecurity() in server/site.mjs).

Analytics (only when an operator sets GOOGLE_ANALYTICS_ID and a visitor accepts):

• Page views are sent by the site itself, with a scrubbed address and title (analyticsPage() in platform/lib/analytics.js).
• Public timelines and their moment and duration pages are sent as they are.
• Other timeline pages are sent as /timelines.
• /compare, /editor and /connect are sent without their ids or codes.
• Queries are dropped.
• Titles come from the site's own page names.
• The consent banner says private timelines' titles and addresses are never sent.
• docs/administration.md asks operators to turn off three of GA's "Enhanced measurement" options that code can't.

Embeds:

• Titles: an embed's title, and the editor frame's heading image address, are inserted with a function replacement. A timeline title with $ patterns stays as written.

Tests:

• New unit tests:
• analytics.test.mjs: the scrubbing rules;
• editor-routes.test.mjs: titles with $ patterns, and HSTS and framing on the frame and embed routes;
• site.test.mjs.
• Platform: next-platform.mjs checks the headers on /compare, /privacy, /terms, 404s and unknown timeline addresses.
• PostgreSQL: sharing-postgres.mjs checks which pages are marked public for analytics.
• Passing locally: the unit suite, next-platform, next-postgres, and sharing-postgres up to its browser steps, which run in CI.

Docs: docs/administration.md, docs/sharing.md, platform/README.md.

🤖 Generated with Claude Code

https://claude.ai/code/session_011fFY8eruEi1xAkkMBni13B

[Anonymous]

Ticket changed by: athanclark

• status: open --> closed