chore(security-headers): drop console-noise warnings from dev tools

Three real fixes (one inline-script CSP violation, six obsolete
Permissions-Policy features, one helmet default that warns instead
of helping). Two warnings deliberately left alone with rationale in
the changelog (COOP-on-HTTP needs HTTPS in production; Edge tracking
prevention on 3rd-party CDNs would need a self-hosting refactor).

- src/server.js: helmet({ originAgentCluster: false }) +
  trim Permissions-Policy to recognized features only.
- public/js/login-reset.js: extracted from inline <script> in
  index.html so the script-src 'self' directive accepts it.
- public/index.html: <script src=…> in place of the inline block.

Release: v7.3.7

Author: bogdanpricop

CHANGELOG.md

@@ -2,6 +2,24 @@
 
 All notable changes to Docker Dash are documented here.
 
+## [7.3.7] - 2026-04-25 — Browser console hygiene
+
+A user-driven cleanup pass on the dev-tools console output. Three real issues, three drive-by warnings I left alone (and explain why).
+
+### Fixed
+
+- **CSP blocked inline `<script>`** in the login screen (`Executing inline script violates the following Content Security Policy directive`). The forgot-password reveal/submit handler lived inline in `public/index.html`. Extracted to [`public/js/login-reset.js`](public/js/login-reset.js) and referenced via `<script src=…>` so the existing `script-src 'self'` directive accepts it. No `unsafe-inline` was added (would defeat the point of CSP).
+
+- **Permissions-Policy "Unrecognized feature" warnings** for six entries the current browsers no longer understand: `ambient-light-sensor` (early proposal, never standardized), `battery` (removed for privacy), `document-domain` (not a Permissions-Policy feature — lives in CSP/headers), `execution-while-not-rendered`, `execution-while-out-of-viewport`, `navigation-override` (all three Chrome-only, never standardized). Removed from the header in [`src/server.js`](src/server.js#L52-L74). All six are still safe at the platform level — listing them here was warning-noise, not protection.
+
+- **Origin-Agent-Cluster mismatch warning** ("could not be origin-keyed since the origin had previously been placed in a site-keyed agent cluster"). Helmet defaults to sending `Origin-Agent-Cluster: ?1`, which only takes effect if every page on the origin opts in consistently — our SPA doesn't, so the warning fires on every page load. Disabled via `helmet({ originAgentCluster: false })`. We don't need agent-cluster keying for our use case.
+
+### Not fixed (and why)
+
+- **`Cross-Origin-Opener-Policy header has been ignored, because the URL's origin was untrustworthy`** — fires on plain HTTP. The browser refuses COOP enforcement on insecure origins. Goes away in production behind HTTPS (Caddy `--profile tls` or any other TLS termination). No code fix needed.
+
+- **`Tracking Prevention blocked access to storage for <URL>`** — Edge's strict tracking prevention blocking 3rd-party storage for our CDN dependencies (jsDelivr, cdnjs, Google Fonts). Browser-side feature, can't be turned off from server. Could be eliminated by self-hosting Chart.js / FontAwesome / fonts — large refactor for a cosmetic warning. Deferred.
+
 ## [7.3.5] - 2026-04-25 — WS cookie-first auth + What's New update banner
 
 ### Fixed

docker-compose.yml

@@ -4,8 +4,8 @@ services:
       context: .
       dockerfile: Dockerfile
       args:
-        APP_VERSION: "${APP_VERSION:-7.3.5}"
-    image: docker-dash:${APP_VERSION:-7.3.5}
+        APP_VERSION: "${APP_VERSION:-7.3.7}"
+    image: docker-dash:${APP_VERSION:-7.3.7}
     container_name: docker-dash
     restart: unless-stopped
     env_file:
@@ -54,7 +54,7 @@ services:
   dd-egress-filter:
     build:
       context: ./docker/egress-filter
-    image: docker-dash-egress-filter:${APP_VERSION:-7.3.5}
+    image: docker-dash-egress-filter:${APP_VERSION:-7.3.7}
     container_name: dd-egress-filter
     restart: unless-stopped
     # Uses the default bridge so target containers on the default bridge can

package.json

@@ -1,6 +1,6 @@
 {
   "name": "docker-dash",
-  "version": "7.3.5",
+  "version": "7.3.7",
   "description": "Full-featured Docker management dashboard",
   "main": "src/server.js",
   "scripts": {

public/index.html

@@ -54,58 +54,7 @@
             <button type="button" id="login-reset-submit" class="btn btn-primary btn-sm"><i class="fas fa-paper-plane"></i> Send reset link</button>
           </div>
         </div>
-        <script>
-          (function () {
-            var link = document.getElementById('login-forgot-link');
-            var form = document.getElementById('login-reset-form');
-            var cancelBtn = document.getElementById('login-reset-cancel');
-            var submitBtn = document.getElementById('login-reset-submit');
-            var emailInput = document.getElementById('login-reset-email');
-            var errorEl = document.getElementById('login-reset-error');
-            var successEl = document.getElementById('login-reset-success');
-
-            link.addEventListener('click', function (e) {
-              e.preventDefault();
-              form.style.display = 'block';
-              link.parentElement.style.display = 'none';
-              emailInput.focus();
-            });
-
-            cancelBtn.addEventListener('click', function () {
-              form.style.display = 'none';
-              link.parentElement.style.display = 'block';
-              emailInput.value = '';
-              errorEl.style.display = 'none';
-              successEl.style.display = 'none';
-              submitBtn.disabled = false;
-              submitBtn.innerHTML = '<i class="fas fa-paper-plane"></i> Send reset link';
-            });
-
-            submitBtn.addEventListener('click', async function () {
-              var email = emailInput.value.trim();
-              errorEl.style.display = 'none';
-              successEl.style.display = 'none';
-              if (!email) { errorEl.textContent = 'Please enter your email address.'; errorEl.style.display = 'block'; return; }
-              submitBtn.disabled = true;
-              submitBtn.innerHTML = '<i class="fas fa-spinner fa-spin"></i> Sending...';
-              try {
-                await fetch('/api/auth/request-password-reset', {
-                  method: 'POST',
-                  headers: { 'Content-Type': 'application/json' },
-                  body: JSON.stringify({ email: email }),
-                });
-              } catch (e) { /* ignore network errors — show generic message regardless */ }
-              successEl.textContent = "If an account exists with that email, you'll receive a reset link.";
-              successEl.style.display = 'block';
-              submitBtn.style.display = 'none';
-              cancelBtn.textContent = 'Close';
-            });
-
-            emailInput.addEventListener('keydown', function (e) {
-              if (e.key === 'Enter') submitBtn.click();
-            });
-          })();
-        </script>
+        <script src="/js/login-reset.js?v=__VERSION__"></script>
       </form>
       <div id="oidc-section" class="hidden" style="margin-top:16px">
         <div style="display:flex;align-items:center;gap:12px;margin-bottom:12px">

public/js/login-reset.js

@@ -0,0 +1,76 @@
+'use strict';
+
+// Login → forgot-password reveal + submit handler. Lives on the login screen
+// before the main app loads, so it can't depend on Api/Toast/i18n. Pure
+// vanilla DOM + fetch.
+//
+// Extracted from inline <script> in index.html in v7.3.7 to comply with the
+// Content Security Policy (no 'unsafe-inline' for script-src).
+(function () {
+  function init() {
+    var link = document.getElementById('login-forgot-link');
+    var form = document.getElementById('login-reset-form');
+    var cancelBtn = document.getElementById('login-reset-cancel');
+    var submitBtn = document.getElementById('login-reset-submit');
+    var emailInput = document.getElementById('login-reset-email');
+    var errorEl = document.getElementById('login-reset-error');
+    var successEl = document.getElementById('login-reset-success');
+
+    if (!link || !form || !cancelBtn || !submitBtn || !emailInput || !errorEl || !successEl) {
+      return;  // Login markup not present (rare in non-app contexts) — bail
+    }
+
+    link.addEventListener('click', function (e) {
+      e.preventDefault();
+      form.style.display = 'block';
+      link.parentElement.style.display = 'none';
+      emailInput.focus();
+    });
+
+    cancelBtn.addEventListener('click', function () {
+      form.style.display = 'none';
+      link.parentElement.style.display = 'block';
+      emailInput.value = '';
+      errorEl.style.display = 'none';
+      successEl.style.display = 'none';
+      submitBtn.disabled = false;
+      submitBtn.innerHTML = '<i class="fas fa-paper-plane"></i> Send reset link';
+    });
+
+    submitBtn.addEventListener('click', async function () {
+      var email = emailInput.value.trim();
+      errorEl.style.display = 'none';
+      successEl.style.display = 'none';
+      if (!email) {
+        errorEl.textContent = 'Please enter your email address.';
+        errorEl.style.display = 'block';
+        return;
+      }
+      submitBtn.disabled = true;
+      submitBtn.innerHTML = '<i class="fas fa-spinner fa-spin"></i> Sending...';
+      try {
+        await fetch('/api/auth/request-password-reset', {
+          method: 'POST',
+          headers: { 'Content-Type': 'application/json' },
+          body: JSON.stringify({ email: email }),
+        });
+      } catch (e) { /* ignore network errors — show generic message regardless */ }
+      successEl.textContent = "If an account exists with that email, you'll receive a reset link.";
+      successEl.style.display = 'block';
+      submitBtn.style.display = 'none';
+      cancelBtn.textContent = 'Close';
+    });
+
+    emailInput.addEventListener('keydown', function (e) {
+      if (e.key === 'Enter') submitBtn.click();
+    });
+  }
+
+  // The script tag is loaded after the markup, so DOM is already parsed,
+  // but tolerate both timings.
+  if (document.readyState === 'loading') {
+    document.addEventListener('DOMContentLoaded', init);
+  } else {
+    init();
+  }
+})();

public/js/pages/whatsnew.js

@@ -9,6 +9,17 @@ const WhatsNewPage = {
   // Add new releases at the TOP of this array.
   // Types: feature, fix, improvement, security, breaking
   _releases: [
+    {
+      version: '7.3.7',
+      date: '2026-04-25',
+      title: 'Browser console hygiene',
+      changes: [
+        { type: 'fix', text: 'CSP blocked an inline <script> on the login screen (the forgot-password reveal/submit handler). Extracted to public/js/login-reset.js so the existing script-src \'self\' directive accepts it. No \'unsafe-inline\' added.' },
+        { type: 'fix', text: 'Six "Unrecognized feature" warnings in the Permissions-Policy header — removed entries that current browsers no longer understand: ambient-light-sensor, battery, document-domain, execution-while-not-rendered, execution-while-out-of-viewport, navigation-override. All six are still safe at the platform level — listing them here was warning-noise, not protection.' },
+        { type: 'fix', text: 'Origin-Agent-Cluster mismatch warning ("could not be origin-keyed"). Helmet sends ?1 by default but our SPA doesn\'t opt every page in consistently. Disabled via helmet({ originAgentCluster: false }) since we don\'t need agent-cluster keying.' },
+        { type: 'improvement', text: 'Two warnings left intentionally: COOP-on-HTTP (browser refuses on insecure origin — goes away behind HTTPS) and Edge Tracking Prevention blocking 3rd-party CDN storage (browser feature, would need self-hosting Chart.js + FontAwesome + fonts to silence — deferred).' },
+      ],
+    },
     {
       version: '7.3.5',
       date: '2026-04-25',

src/server.js

@@ -46,18 +46,34 @@ app.use(helmet({
     },
   },
   frameguard: { action: 'deny' },
+  // v7.3.7: disable Origin-Agent-Cluster (Helmet default sends `?1`).
+  // Without explicitly opting in on every page, the header gets ignored
+  // with a console warning ("could not be origin-keyed since the origin
+  // had previously been placed in a site-keyed agent cluster"). We don't
+  // need agent-cluster keying for our SPA, so just stop sending it.
+  originAgentCluster: false,
 }));
 
 // Permissions-Policy — explicitly deny browser APIs we never use. Any future
 // feature that needs one of these (e.g. audio notifications) must opt-in here.
+// v7.3.7: dropped 6 features that current browsers don't recognize (Edge
+// console flagged each as "Unrecognized feature"):
+//   - ambient-light-sensor (early proposal, never standardized)
+//   - battery (removed from spec for privacy)
+//   - document-domain (not a Permissions-Policy feature; lives in CSP/headers)
+//   - execution-while-not-rendered, execution-while-out-of-viewport (Chrome-only,
+//     never standardized)
+//   - navigation-override (Chrome-only, never standardized)
+// All six are still safe defaults at the platform level — listing them
+// here was warning-noise, not protection.
 app.use((req, res, next) => {
   res.setHeader(
     'Permissions-Policy',
-    'accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), ' +
-    'cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), ' +
-    'execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(self), ' +
-    'geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), ' +
-    'midi=(), navigation-override=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), ' +
+    'accelerometer=(), autoplay=(), camera=(), ' +
+    'cross-origin-isolated=(), display-capture=(), encrypted-media=(), ' +
+    'fullscreen=(self), geolocation=(), gyroscope=(), keyboard-map=(), ' +
+    'magnetometer=(), microphone=(), midi=(), payment=(), ' +
+    'picture-in-picture=(), publickey-credentials-get=(), ' +
     'screen-wake-lock=(), sync-xhr=(), usb=(), web-share=(), xr-spatial-tracking=()'
   );
   next();

src/version.js

@@ -2,4 +2,4 @@
 // Single source of truth for the application version.
 // Updated automatically by: npm version X.Y.Z  (via scripts/sync-version.js)
 // server.js reads this to inject into index.html at startup — no build step needed.
-module.exports = '7.3.5';
+module.exports = '7.3.7';