Overview#
Web Application Hardening is the platform's browser-facing defence layer, combining strict content security policies, anti-forgery and origin enforcement, neutralisation of untrusted content, encrypted offline storage, and privacy-preserving diagnostics into a single coherent posture across the emergency, collaboration, administration, and sign-in surfaces.
The web browser is a hostile environment for intelligence and emergency platforms: imported content, shared machines, and cross-site attacks all converge on the same signed-in session. An analyst who clicks a link planted in imported follower data, an operator who signs out of a shared control-room terminal, or a dispatcher whose console renders external alert text is exposed to a class of threat that no server-side control can reach on its own. This layer addresses that exposure directly. It serves tenant security officers who must evidence these controls in procurement and audit reviews, and it protects every analyst, operator, and dispatcher who works in a browser all shift.
Key Features#
- Strict Content Security Policy: The emergency operator console runs eval-free, with dynamic script evaluation eliminated and style sources locked down, while the sign-in portal follows a staged, nonce-based migration: every response carries a parallel report-only strict policy and a live violation-report collector, so inline-script allowances can be removed with evidence and zero downtime.
- Origin and Anti-Forgery Enforcement: Every state-changing request that rides a session, including emergency call notes and AI-assisted operations, enforces origin validation plus anti-forgery tokens and fails closed; sign-in redirects are checked against a strict allowlist, shared collaboration links are minted only for fully validated sessions and scoped to the server-verified organisation, and client-supplied identity headers are stripped at the gateway so only server-derived identity propagates.
- Untrusted Content Neutralisation: Externally sourced links from OSINT profiles, attachments, news syndication, and public alerts pass a canonical URL sanitiser that blocks script-scheme payloads; public alert map popups escape all text, SVG files are excluded from evidence upload accept-lists, and AI chat rendering blocks embedded image elements to prevent exfiltration through generated content.
- Injection-Safe Exports: All CSV exports route through a shared formula-safe escaper so exported cells cannot execute as spreadsheet formulas on an analyst's machine, and spreadsheet exports strip characters that would corrupt or weaponise the file.
- Encrypted Offline Data: Attachments held for offline work, including health-identifying material, are encrypted at rest in the browser's local store with per-session keys that are generated non-extractable, held in memory only, and never written to any storage.
- Minimised Browser Footprint: Chain-of-custody events buffer in memory only, evidence upload history keeps only anonymous batch status, validated user profiles are cached in memory with a hard one-minute ceiling, one-time authenticator secrets are cleared when the enrolment dialogue closes, and push notification payloads are stripped before reaching the operating system.
- Per-User Cache Isolation and Sign-Out Purge: Cached query results are strictly isolated per user, offline caches never serve one user's credentialed content to another on a shared device, and the browser tab purges all local data the moment the server reports the session is no longer authenticated.
- Internal Network Protection: URL-profiling and orchestration features validate targets server-side and refuse requests aimed at private or internal addresses, while proxy endpoints enforce strict allowlists and redirect-host checks.
- Privacy-Preserving Diagnostics: Error reports are scrubbed of tokens, emails, keys, and query strings before leaving the browser; technical detail appears only behind an explicit debug opt-in, and operational logs carry counts and anonymous identifiers rather than tenant identity or transcript fragments.
Use Cases#
- Tenant Security Officer Assurance: A security officer answering a public-safety procurement questionnaire cites the eval-free operator console policy and verifies that every mutating operation enforces origin and anti-forgery checks, with each of those request protections locked by an automated regression guard.
- Shared Control-Room Workstations: A supervisor confirms that a shared terminal retains no readable case data, custody records, upload history, or credentials after an operator signs out.
- OSINT Analyst Safety: An analyst exports enrichment results and opens them in a spreadsheet without risk of embedded formula execution, and clicks collected profile links knowing a crafted URL cannot hijack the authenticated session.
- Field Confidentiality: A paramedic's offline attachments remain confidential even if the device's browser profile is copied, because the encryption keys never touch disk.
- Safe Support Escalation: A support engineer shares error telemetry with the platform team without exposing user tokens, personal data, or a tenant's case material.
Integration#
Web Application Hardening is the browser-side counterpart to the platform's server-side controls. It complements session management, which governs sign-in lifetimes and revocation; multi-tenant access control, which enforces organisation isolation on the server; security policy administration, where content security posture is managed; evidence upload management, which screens incoming files; and audit logging, which records the actions these controls protect. Offline field operations rely on its encrypted local storage, and the privacy programme relies on its redacted diagnostics pipeline.
Open Standards#
- W3C Content Security Policy: Strict script and style policies protect the operator console, while per-request nonces and standard violation reports drive the staged enforcement rollout on the sign-in portal.
- RFC 6454 (The Web Origin Concept): Origin validation on every state-changing request follows the browser origin model, rejecting spoofed or untrusted request origins.
- OAuth 2.0: Sign-in flows validate the public origin against a strict allowlist and refuse to redirect through spoofed or wildcard hosts.
- W3C Web Cryptography API: Offline encryption keys are generated non-extractable through the browser's standard cryptography interface and are held in memory only.
- OWASP Guidance: Key-derivation strength for offline encryption meets current OWASP recommendations and is locked against weakening; anti-forgery, injection, and request-forgery defences align with OWASP-documented threat classes.
- GDPR (Regulation (EU) 2016/679): The redacted diagnostics pipeline applies data-minimisation principles so personal data and tenant identity stay out of logs and error reports.
Last Reviewed: 2026-07-16 Last Updated: 2026-07-16