[pull] main from danny-avila:main

.env.example

@@ -73,6 +73,93 @@ NO_INDEX=true
 # Defaulted to 1.
 TRUST_PROXY=1
 
+#===============================#
+# Security Headers              #
+#===============================#
+
+# Baseline HTTP security headers (HSTS, X-Frame-Options, X-Content-Type-Options,
+# COOP, CORP, Referrer-Policy) are sent on every response. Content-Security-Policy
+# is never set here. Set to false to send no security headers at all.
+# SECURITY_HEADERS=true
+
+# Strict-Transport-Security. Only meaningful over HTTPS; browsers ignore it on
+# plain HTTP. HSTS_INCLUDE_SUBDOMAINS applies the policy to every subdomain of
+# this host for the full max-age, so enable it only if all of them serve HTTPS.
+# HSTS_ENABLED=true
+# HSTS_MAX_AGE=31536000
+# HSTS_INCLUDE_SUBDOMAINS=false
+# HSTS_PRELOAD=false
+
+# X-Frame-Options. Set to DENY to block all framing, or to `off` if you embed
+# LibreChat in an iframe on another origin.
+# X_FRAME_OPTIONS=SAMEORIGIN
+
+# Referrer-Policy. Any standard token, or `off` to omit the header.
+# REFERRER_POLICY=no-referrer
+
+# Cross-Origin-Opener-Policy. Use same-origin-allow-popups if a popup-based
+# sign-in flow needs to reach back to the window that opened it.
+# CROSS_ORIGIN_OPENER_POLICY=same-origin
+
+# Cross-Origin-Resource-Policy. Use cross-origin if other sites need to load
+# resources served by LibreChat, such as uploaded images.
+# CROSS_ORIGIN_RESOURCE_POLICY=same-origin
+
+#===============================#
+# Content Security Policy       #
+#===============================#
+
+# Nonce-based CSP for the SPA HTML response. Off by default so existing
+# deployments are unaffected. Turn it on in report-only mode first, review the
+# violations your deployment actually produces, then set CSP_REPORT_ONLY=false.
+# Only an explicit false/off/0/no enforces; anything unrecognized warns and stays
+# report-only, so a typo cannot silently start blocking scripts.
+# CSP_ENABLED=false
+# CSP_REPORT_ONLY=true
+# CSP_REPORT_URI=
+
+# The default policy accommodates what LibreChat actually loads at runtime:
+#   script-src  'wasm-unsafe-eval'  HEIC image conversion compiles WebAssembly
+#   worker-src  data:               Monaco's loader bootstraps workers from data:
+# Both are narrower than 'unsafe-eval'. Set these to false to drop them if your
+# deployment uses neither HEIC uploads nor the artifact code editor. (The CSP_*_EXTRA
+# and CSP_ADDITIONAL_DIRECTIVES variables only add sources; they cannot remove one.)
+# CSP_ALLOW_WASM=true
+# CSP_ALLOW_DATA_WORKERS=true
+
+# While CSP is enabled the SPA shell is always sent as `no-store` and the
+# INDEX_CACHE_CONTROL / INDEX_PRAGMA / INDEX_EXPIRES overrides are ignored for it.
+# A cached shell would pin a single nonce across page loads and users, which is
+# precisely what a nonce policy exists to prevent.
+#
+# SECURITY_HEADERS=false disables CSP too; it is the global kill switch.
+
+# Add deployment-specific sources on top of LibreChat's defaults; they are
+# appended, never replacing them. Comma- or space-separated. Quote values
+# containing spaces.
+# CSP_CONNECT_SRC_EXTRA="https://telemetry.example.com wss://stream.example.com"
+# CSP_FRAME_SRC_EXTRA="https://tenant.sharepoint.com"
+# CSP_IMG_SRC_EXTRA="https://cdn.example.com"
+# CSP_STYLE_SRC_EXTRA=
+# CSP_FONT_SRC_EXTRA=
+# CSP_MEDIA_SRC_EXTRA=
+# CSP_WORKER_SRC_EXTRA=
+# CSP_FORM_ACTION_EXTRA=
+# CSP_DEFAULT_SRC_EXTRA=
+
+# Script hosts get their own note: the default policy uses 'strict-dynamic',
+# which makes browsers ignore every host source in script-src. Setting this
+# drops 'strict-dynamic' so the hosts you list actually take effect.
+# CSP_SCRIPT_SRC_EXTRA="https://trusted-scripts.example.com"
+
+# Who may frame LibreChat. Defaults to 'self'. Replace it if you embed LibreChat
+# in a portal on another origin, and set X_FRAME_OPTIONS=off alongside it since
+# older browsers honor that header instead.
+# CSP_FRAME_ANCESTORS="'self' https://portal.example.com"
+
+# Raw directives appended to the policy, separated by semicolons.
+# CSP_ADDITIONAL_DIRECTIVES="upgrade-insecure-requests"
+
 # Trust X-Tenant-Id on unauthenticated routes. Disabled by default.
 # Enable only when a trusted reverse proxy strips any client-supplied value and sets its own.
 # TRUST_TENANT_HEADER=false