GWM : CSP

app/controllers/submission.controller.js

@@ -885,7 +885,7 @@ exports.getBeforePreviousData = async (req, res) => {
     // compute the quarter two steps before (before-previous)
     // e.g. current Q1 -> before-previous = Q3 (year - 1)
     //      current Q4 -> before-previous = Q2 (same year)
-    let beforePrevQuarterNum = currentQuarterNum - 2;
+    let beforePrevQuarterNum = currentQuarterNum - 1;
     let targetYear = yearNum;
     if (beforePrevQuarterNum <= 0) {
       beforePrevQuarterNum += 4;

app/routes/routes.js

@@ -57,8 +57,8 @@ const upload = multer({ dest: UPLOAD_DIR });
  *     description: Manage notification templates
  *   - name: Quarterly Windows Configuration
  *     description: Manage quarterly windows configuration master data
- *   - name: Establishment Password Reset Requests
- *     description: Manage Establishment Password Reset Requests
+ *   - name: Establishment Pwd Reset Requests
+ *     description: Manage Establishment Pwd Reset Requests
  *   - name: Master
  *     description: 
  */
@@ -2782,8 +2782,8 @@ router.post("/forgot-password/request-otp", establishmentController.forgotPasswo
  * @swagger
  * /api/forgot-password/verify-otp:
  *   post:
- *     summary: Verify OTP and reset establishment user password
- *     tags: [Establishment Password Reset Requests]
+ *     summary: Verify OTP and reset establishment user Pwd
+ *     tags: [Establishment Pwd Reset Requests]
  *     requestBody:
  *       required: true
  *       content:

server.js

@@ -16,31 +16,38 @@ const app = express();
 // REQUIRED for HSTS when behind proxy (AWS ALB / Nginx / Cloudflare)
 app.set("trust proxy", 1);
 
-const isLocal = process.env.NODE_ENV === "development";
-
 // GLOBAL MIDDLEWARE (body parsing)
 app.use(express.json());
 app.use(cookieParser());
 
-// HELMET 
+const isLocal = process.env.NODE_ENV === "development";
+
 app.use(
   helmet({
-    contentSecurityPolicy: false,
+    contentSecurityPolicy: {
+      directives: {
+        defaultSrc: ["'none'"],
+        connectSrc: ["'self'"],
+        scriptSrc: ["'self'", "'unsafe-inline'"],
+        styleSrc: ["'self'", "'unsafe-inline'"],
+        imgSrc: ["'self'", "data:"],
+        fontSrc: ["'self'", "data:"],
+        frameAncestors: ["'none'"],
+        baseUri: ["'none'"],
+        formAction: ["'self'"],
+      },
+    },
   })
 );
 
-// prevent framing (clickjacking protection)
-app.use(
-  helmet.frameguard({
-    action: "deny",
-  })
-);
+// Clickjacking protection
+app.use(helmet.frameguard({ action: "deny" }));
 
-//HSTS (ENABLE FOR UAT + PROD)
+// HSTS for UAT + PROD
 if (!isLocal) {
   app.use(
     helmet.hsts({
-      maxAge: 31536000, // 1 year
+      maxAge: 31536000,
       includeSubDomains: true,
       preload: true,
     })