Security Headers and Attack Surface¶

The NovaTrek Architecture Portal is a static site — pre-rendered HTML, CSS, and JavaScript files served from a CDN with no server-side code execution. This fundamentally limits the attack surface compared to dynamic web applications like Confluence.

NIST SP 800-123 (Guide to General Server Security) and SP 800-95 (Guide to Secure Web Services) strongly emphasize minimizing server-side execution and reducing the footprint of web-hosted content. The static delivery model aligns directly with this federal guidance, transitioning the threat model from defending a persistently running application to serving immutable files via a CDN.

For the complete evidence base, see Research Results.

HTTP Security Headers¶

All security headers are defined in staticwebapp.config.json and are version-controlled, reviewed in PRs, and deployed through the CI/CD pipeline. The security team can propose changes to these headers through the same PR workflow as any other content change.

Current Headers¶

Content Security Policy¶

The CSP is the most important security header. It controls exactly which resources the browser is allowed to load:

default-src 'self';
script-src 'self' 'unsafe-inline' 'unsafe-eval' https://unpkg.com;
style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://unpkg.com;
font-src 'self' https://fonts.gstatic.com;
img-src 'self' data: https:;
connect-src 'self'

CSP Hardening Roadmap¶

The current CSP includes 'unsafe-inline' and 'unsafe-eval' for MkDocs Material compatibility. These can be progressively tightened:

Each phase is a change to staticwebapp.config.json — reviewed, tested, and deployed through the same pipeline.

Confluence CSP Limitations¶

By contrast, implementing a rigorous CSP in Confluence is significantly constrained:

• Confluence Data Center 10.0 introduced a script-src CSP header, but it operates exclusively in report-only mode — the browser logs violations but does not block malicious execution. Full enforcement is not expected until future versions (Confluence 10.0 Release Notes).
• In Confluence Cloud, Forge apps often require injection of unsafe-hashes or complex custom scopes, weakening the CSP that Atlassian can enforce.
• Legacy plugin complexity frequently mandates unsafe-inline or unsafe-eval, which Atlassian explicitly warns weakens security.

Because the docs-as-code architecture serves purely static files with predictable asset origins, administrators can enforce strict CSP headers without breaking functionality. A static site can lock down to default-src 'self' as a baseline, rejecting any injected script — a posture Confluence cannot replicate without severe functional degradation.

Attack Surface Comparison¶

Static Site (MkDocs on Azure Static Web Apps)¶

┌─────────────────────────────────────────┐
│           Attack Surface                 │
│                                          │
│  ┌──────────┐   ┌──────────────────┐    │
│  │   CDN    │   │  Static Files    │    │
│  │ (Azure   │──▶│  HTML, CSS, JS   │    │
│  │  Front   │   │  SVG, JSON       │    │
│  │  Door)   │   │                  │    │
│  └──────────┘   └──────────────────┘    │
│                                          │
│  No database                             │
│  No server-side code                     │
│  No file uploads                         │
│  No user input processing                │
│  No authentication endpoints (*)         │
│  No plugin runtime                       │
│  No session management                   │
│                                          │
│  (*) Auth handled by Azure platform      │
│      layer, separate from content        │
└─────────────────────────────────────────┘

Potential attack vectors: DNS hijacking, CDN compromise, TLS downgrade, CSP bypass. All managed at the Azure platform level with enterprise-grade protections.

Dynamic Site (Confluence Cloud)¶

┌─────────────────────────────────────────┐
│           Attack Surface                 │
│                                          │
│  ┌──────────┐   ┌──────────────────┐    │
│  │   Load   │   │  Java App Server │    │
│  │ Balancer │──▶│  (Spring/Tomcat)  │    │
│  └──────────┘   │                  │    │
│                  │  ┌────────────┐  │    │
│  ┌──────────┐   │  │ Plugin     │  │    │
│  │ Database │◀──│  │ Runtime    │  │    │
│  │ (Postgres)│   │  └────────────┘  │    │
│  └──────────┘   │                  │    │
│                  │  ┌────────────┐  │    │
│  ┌──────────┐   │  │ Rich Text  │  │    │
│  │  File    │◀──│  │ Editor     │  │    │
│  │ Storage  │   │  └────────────┘  │    │
│  └──────────┘   │                  │    │
│                  │  ┌────────────┐  │    │
│  ┌──────────┐   │  │ REST API   │  │    │
│  │ Session  │◀──│  │ Endpoints  │  │    │
│  │  Store   │   │  └────────────┘  │    │
│  └──────────┘   └──────────────────┘    │
│                                          │
│  Database injection                      │
│  Server-side code execution              │
│  File upload exploitation                │
│  XSS via rich text editor                │
│  Plugin vulnerabilities                  │
│  Session hijacking                       │
│  API authentication bypass               │
│  Deserialization attacks                  │
└─────────────────────────────────────────┘

Historical evidence: Confluence has been the subject of at least nine CISA KEV alerts for active exploitation. Critical CVEs include:

A static site is immune to all of these attack categories because the attack vectors (server-side code execution, database access, plugin runtime) do not exist.

Caching and Performance Security¶

The portal uses differentiated caching policies:

The immutable directive on hashed assets prevents cache poisoning attacks — once an asset is cached, it cannot be replaced without changing the URL.

Infrastructure Security¶

Azure Static Web Apps provides:

The deployment token used by CI/CD can only upload static files to a specific Azure Static Web App. It cannot:

• Access other Azure resources
• Modify network configuration
• Read data from other services
• Modify authentication settings

This is the principle of least privilege applied to the deployment pipeline.