Page Protect

Page Protect is a Cloudflare Page Shield-style client-side security feature. It monitors, inventories, and enforces client-side resources (scripts, connections) loaded by website visitors via Content-Security-Policy (CSP) headers, with log-based violation report collection, a CSP policy builder, script inventory with code-change detection, an inventory beacon, beacon trust, and a policy recommender — all scoped per-backend and integrated into the existing HAProxy config generation pipeline.

How It Works

  Browser loads page
       │
       │  1. HAProxy serves HTML response
       │     - Injects <script src="/_cx-assets.js"> (if beacon enabled)
       │     - Sets Server-Timing: cxid header (if beacon trust enabled)
       │     - Sets Content-Security-Policy header (per backend policy)
       │
       ▼
  Browser loads resources (scripts, styles, images, XHR)
       │
       │  2. CSP violation? → POST to /_csp-report
       │     3. Beacon JS collects Resource Timing entries
       │        + reads cxid from Server-Timing
       │        → POST to /_cx-assets
       │
       ▼
  HAProxy captures both in JSON log-format (txn.csp_report, txn.asset_beacon)
       │
       ▼
  Page Protect Sampler (background thread, every 10s)
       │  - Reads HAProxy container logs via Docker SDK
       │  - Parses CSP reports → stores in csp_reports table
       │  - Parses beacon POSTs → upserts script inventory (source="beacon")
       │  - Prunes old reports (report_retention_days)
       │
       ▼
  Page Protect Hasher (background thread, every 60s)
       │  - Fetches due script URLs via httpx (HTTP/2)
       │  - Computes SHA-256, compares to last-known hash
       │  - Flags hash_changed on mismatch
       │  - Bypasses WAF/rate-limit/security rules via X-CoreX-Internal token
       │
       ▼
  Dashboard / Inventory / Reports tabs in the UI

Four Pillars

1. CSP Report Collection — HAProxy captures CSP violation report POST bodies in its JSON log-format (txn.csp_report var); a background sampler reads HAProxy container logs via Docker SDK, extracts reports, and stores them in the database.
2. CSP Policy Builder — A dedicated PageProtectPolicy model (scoped per-backend via backend_ids) generates CSP headers (Content-Security-Policy for enforce, Content-Security-Policy-Report-Only for monitor) emitted in HAProxy backend sections. Separate from the generic Response Headers feature.
3. Script/Connection Inventory — The sampler parses CSP reports and beacon POSTs to build/maintain an inventory of detected scripts, connections, and other resources with first-seen/last-seen tracking, domain attribution, and source tracking (csp, manual, or beacon).
4. Code Change Detection — A background hasher periodically fetches detected script URLs, computes SHA-256 hashes, and flags changes (supply-chain attack detection).

UI Tabs

The Page Protect page (Protection > Page Protect) has 6 tabs:

Dashboard Tab

The dashboard shows 4 stat cards and 2 top-lists:

• Top Violated Directives — most frequently violated CSP directives
• Top Blocked URIs — most frequently blocked resource URIs

Auto-refreshes every 15 seconds.

Policies Tab

CSP policies are scoped per-backend (via backend_ids; empty = all backends). Each policy generates a CSP header emitted in the HAProxy backend section.

Policy Fields

CSP Directives

Each directive accepts:

• 'self' — same origin
• 'none' — no sources
• 'unsafe-inline', 'unsafe-eval', 'strict-dynamic' — special keywords
• Specific URLs (e.g. https://cdn.example.com)
• Nonces (per-request generated)
• Hashes

Directive Editor

The policy form includes a visual directive editor:

• Add/remove directives from a dropdown of all CSP directives
• Add sources to each directive via text input (press Enter or click Add)
• Remove individual sources with the × button
• Live CSP header preview at the bottom of the form

Auto-Suggest from Inventory

When the script inventory has detected scripts or connections, the policy form shows clickable suggestions:

• Detected scripts (blue chips) — click to add to script-src
• Detected connections (purple chips) — click to add to connect-src

Policy Recommender

The Recommend Policy button analyzes the script inventory and CSP violation reports to generate a recommended CSP policy:

1. Click Recommend Policy (optionally filter by backend first)
2. A modal shows:
   • Summary: scripts analyzed, reports analyzed, baseline window, backend filter
   • Warnings (e.g. origins seen from < 2 distinct IPs — may be attacker probes)
   • Recommended directives (preview)
   • Per-origin details: origin, occurrence count, distinct IPs (amber if < 2)
3. Click Apply to Form to populate the policy form with the recommendations
4. Edit further before saving

The recommender uses the baseline window if one is set (see Baseline Tab).

Inventory Tab

The inventory tracks all client-side resources detected via CSP reports, beacon POSTs, or manual entry.

Inventory Fields

Sorting and Filtering

• Sort — click any column header to sort ascending/descending (URL, type, domain, source, method, occurrences, last seen, last checked, hash status)
• Filter by type — dropdown to show only a specific resource type
• Filter by status — All, Changed, Unchanged, Ignored

Inventory Actions

Reports Tab

The Reports tab shows captured CSP violation reports.

Report Fields

Click any row to expand and see the full report JSON (referrer, effective directive, original policy, source file, line/column number, status code, script sample, backend name, listener name, report type).

Filtering and Export

• Filter by violated directive — text input
• Filter by hostname — text input
• Export CSV — download all reports (up to 10,000) as CSV
• Clear All — delete all reports (requires write permission)

Baseline Tab

The baseline window defines a collection period for policy recommendations. During a baseline window, the recommender only considers scripts and reports captured within the window.

Baseline States

Baseline Fields

Baseline Workflow

1. Click Start Baseline (optionally add a note)
2. Crawl your site (or have users browse all pages) to ensure complete resource coverage
3. Counts update every 5 seconds
4. Click Stop Baseline when done
5. Go to Policies > Recommend Policy — the recommender uses the baseline window
6. Click Clear to discard the window and start fresh

Settings Tab

Monitoring

Code Change Detection

Inventory Beacon

The inventory beacon injects a <script src="/_cx-assets.js"> tag into HTML responses via the resp_transform Rust filter. The beacon JS uses the Resource Timing API to collect all loaded resources and POSTs them to /_cx-assets. The sampler parses these POSTs and upserts resources with source="beacon".

When beacon is enabled, CSP headers automatically allowlist the beacon script path in script-src (or 'self' is added to default-src).

Beacon Trust

Beacon Trust is an anti-spoofing mechanism that proves a client IP received a real HTML response from coreX. It works alongside the inventory beacon — the beacon JS reads a per-request cxid from the Server-Timing response header and submits it with the beacon POST, and HAProxy validates it before marking the source IP as trusted. Trusted IPs stay trusted for BEACON_TRUST_TTL_SECONDS (default 900s / 15 minutes) with a sliding-window refresh on every subsequent request.

Trusted IPs can be referenced in security rules via the ip.beacon_trusted field (see Security Rules).

Manual Report Collection

The Sample Reports Now button triggers an immediate CSP report sample from coreX logs (instead of waiting for the next sampler interval). Reports the number of new reports stored.

Environment Variables

Step-by-Step: Configure CSP for a Listener

1. Navigate to Protection > Page Protect > Settings
2. Enable Monitoring Enabled
3. Set Report Path to /_csp-report (or your preferred path)
4. Save and Apply Changes — HAProxy now captures CSP violation reports
5. Navigate to Policies
6. Click Add Policy
7. Name: my-csp-policy, Mode: monitor (start with Report-Only)
8. Select the backend(s) it applies to (or leave empty for all)
9. Set default-src to 'self'
10. Set script-src to 'self' plus any allowed CDN URLs (use auto-suggest from inventory if available)
11. Set style-src to 'self' plus any allowed CDN URLs
12. Set img-src to 'self' data: (if using data URIs)
13. Set frame-ancestors to 'none' (clickjacking protection)
14. Review the CSP header preview
15. Save and Apply Changes

Step-by-Step: Use the Policy Recommender

1. Navigate to Protection > Page Protect > Baseline
2. Click Start Baseline (optionally add a note)
3. Crawl your site or have users browse all pages
4. Watch the counts update (scripts, reports, distinct IPs, pages)
5. Click Stop Baseline when done
6. Navigate to Policies
7. Click Add Policy
8. Click Recommend Policy
9. Review the recommended directives, warnings, and per-origin details
10. Click Apply to Form
11. Edit the policy as needed (add/remove directives or sources)
12. Save and Apply Changes

Step-by-Step: Enable the Inventory Beacon

1. Navigate to System > Settings > Advanced
2. Enable Response Transformations and Apply Changes
3. Navigate to Protection > Page Protect > Settings
4. Enable Inventory Beacon
5. Configure beacon settings (endpoint path, script path, content types, path patterns, backends)
6. Save and Apply Changes
7. The beacon JS is now injected into HTML responses
8. Browse your site — resources appear in the Inventory tab with source = Beacon

Step-by-Step: Enable Beacon Trust

1. Ensure Response Transformations is enabled (see above)
2. Ensure Inventory Beacon is enabled (beacon trust requires the beacon JS to read the cxid)
3. Navigate to Protection > Page Protect > Settings
4. Enable Beacon Trust
5. Save and Apply Changes
6. HAProxy now inserts cxid into the Server-Timing header on HTML responses
7. The beacon JS reads it and submits it with the beacon POST
8. Validated IPs are tracked in beacon_trust_table for 15 minutes
9. Use the ip.beacon_trusted field in security rules to gate access on trusted IPs

Step-by-Step: Detect Script Changes (Supply-Chain Monitoring)

1. Navigate to Protection > Page Protect > Settings
2. Enable Code Change Detection
3. Set Change Detection Interval (hours) (e.g. 24 for daily checks)
4. Save and Apply Changes
5. Navigate to Inventory
6. Review detected scripts — the Hash Status column shows OK/Changed/Error/Unchecked
7. Click Check All to force an immediate hash check
8. If a script shows Changed, investigate — it may be a legitimate update or a supply-chain attack
9. If legitimate, click Reset Hash to establish a new baseline
10. If suspicious, click Ignore to stop monitoring it, or Delete to remove it

Verification

1. Check CSP header:

   curl -k -sI https://localhost/ | grep -i content-security-policy

2. Check Server-Timing header (beacon trust):

   curl -k -sI https://localhost/ | grep -i server-timing

   Expect: cxid;desc="<uuid>" on HTML responses (when beacon trust is enabled).

3. Check beacon script injection:

   curl -k -s https://localhost/ | grep -o '_cx-assets.js'

   Expect: the beacon script tag in HTML responses (when beacon injection is enabled).

4. Check inventory:

   • Navigate to Protection > Page Protect > Inventory
   • Verify scripts detected via CSP reports (source = CSP) or beacon (source = Beacon) appear
   • Verify hash status shows OK after the first check

5. Test violation reporting:

   • Open your site in a browser
   • Open developer tools > Console
   • Look for CSP violation reports
   • Verify violations appear in the Reports tab

6. Test enforcement:

   • Switch a policy from monitor to enforce
   • Apply Changes
   • Attempt to load a non-allowlisted script
   • Verify the browser blocks it

7. Test beacon trust:

   • Enable beacon trust (see step-by-step above)
   • Browse your site
   • Navigate to System > Tables
   • Expand beacon_trust_table — verify your IP appears
   • Expand cxid_table — verify recent cxids appear

Next Steps

• Certificates & TLS — Configure HSTS alongside CSP
• Security Rules — Use ip.beacon_trusted to gate access on trusted IPs
• Settings — Enable Response Transformations (required for beacon)
• Metrics & Logging — Monitor CSP violations