Documentación de woku - Guía para desarrolladores

Every HTTP response from woku includes a set of security headers calibrated to earn an A+ rating on securityheaders.com.

Common headers (all domains)

Header	Value	Why
`Strict-Transport-Security`	`max-age=63072000; includeSubDomains; preload`	Forces HTTPS for 2 years in the browser. Eligible for the HSTS preload list.
`X-Content-Type-Options`	`nosniff`	Blocks MIME sniffing.
`X-Frame-Options`	`DENY`	Blocks any framing of the content. Defense in depth on top of `frame-ancestors`.
`Referrer-Policy`	`strict-origin-when-cross-origin`	Does not leak path/query to external sites.
`Permissions-Policy`	`camera=(self), microphone=(self), geolocation=(), interest-cohort=()`	Enables camera/microphone only for woku; blocks geolocation and FLoC.
`Cross-Origin-Opener-Policy`	`same-origin`	Isolates the browsing context to mitigate Spectre.

API (`api.woku.app`)

The API also serves the Swagger documentation at /documentation, which uses its own inline scripts. On the API, all of the headers above are applied and CSP is not enforced because the API is not an HTML surface for users. CSP protection is enforced on the frontends where code that the browser executes runs (review, admin). CORS is restricted to an allowlist (ALLOWED_ORIGINS env var). In development, localhost:5173 (Vite admin) and localhost:3000 (Next.js review) are added automatically.

Public frontend (`review.woku.app`)

In addition to the common headers, this domain applies a nonce-based CSP generated per request:

default-src 'self';
script-src 'self' 'nonce-<random>' 'strict-dynamic';
style-src 'self' 'unsafe-inline';
img-src 'self' blob: data: https://wokuapifiles.s3.us-east-1.amazonaws.com;
font-src 'self' data:;
connect-src 'self' https://api.woku.app wss://api.woku.app;
media-src 'self' blob: https://wokuapifiles.s3.us-east-1.amazonaws.com;
frame-ancestors 'none';
base-uri 'self';
form-action 'self';
object-src 'none';
upgrade-insecure-requests

The key points:

script-src with nonce + strict-dynamic: only the Next.js bundle (which carries the nonce) and the scripts that this bundle loads dynamically are executed. Any <script> injected by an attacker (XSS) is blocked by the browser.
frame-ancestors 'none' + object-src 'none': nobody can embed woku in an <iframe> or load plugins. Defense against clickjacking.
connect-src limited: the frontend can only make XHR/fetch to api.woku.app (HTTPS and WSS). Any exfiltration to other domains is blocked by the browser.
upgrade-insecure-requests: if an http:// resource is left in by mistake, the browser rewrites it to https://.

The nonce is generated with crypto.getRandomValues(16 bytes) encoded in base64. It is unique per request and the browser rejects scripts that do not carry it.

Validation

We periodically test the three domains against:

securityheaders.com → target sustained A+.
Mozilla Observatory → target sustained A+.
Hardenize → full battery (TLS, CSP, HTTPS, HSTS, redirects, certs).

Reporting a downgrade

If you find a woku domain with headers more permissive than those documented here: team@woku.app.

Getting started

Fundamentals

Core concepts

Integration guide

Security

Configuration

Data

Action plans

Alerts

Reports and analytics

Guides

Security headers and CSP

Common headers (all domains)

API (`api.woku.app`)

Public frontend (`review.woku.app`)

Validation

Reporting a downgrade

​Common headers (all domains)

​API (api.woku.app)

​Public frontend (review.woku.app)

​Validation

​Reporting a downgrade

Common headers (all domains)

API (`api.woku.app`)

Public frontend (`review.woku.app`)

Validation

Reporting a downgrade