fix: FORMS-935 CSP Header Implementation

[revanth-banala]

Description

The OWASP Zap Scan process has identified a Medium risk level vulnerability:

Content Security Policy (CSP) is an added layer of security that helps to detect and mitigate certain types of attacks, including Cross Site Scripting (XSS) and data injection attacks. These attacks are used for everything from data theft to site defacement or distribution of malware. CSP provides a set of standard HTTP headers that allow website owners to declare approved sources of content that browsers should be allowed to load on that page — covered types are JavaScript, CSS, HTML frames, fonts, images and embeddable objects such as Java applets, ActiveX, audio and video files.

To satisfy the requirements outlined in the Security Threat and Risk Assessment's (STRA) Statement of Acceptable Risks (SoAR), this vulnerability must be remediated.

Tasks
Learn what this means: how does the CSP work? Is it backend, frontend, both?

Learn what the potential impacts will be to users

Create a fix that addresses the problem

Bonus points: the fix addresses other CSP vulnerabilities in the report

Acceptance Criteria
The fix does not adversely affect users

The vulnerability stops appearing in the OWASP ZAP Scan report

Type of Change

fix (a bug fix)

Checklist

• I have read the CONTRIBUTING doc
• I have checked that unit tests pass locally with my changes
• I have run the npm script lint on the frontend and backend
• I have added tests that prove my fix is effective or that my feature works
• I have added necessary documentation (if appropriate)
• I have approval from the product owner for the contribution in this pull request

Further comments

[revanth-banala]

This is for Testing
Will do ZAP scan to see whether the vulnerabilities are still coming up..

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud