Security

How this origin is configured

This page is about the website. An ECZ-ID does not make anything safe, secure or correct, and nothing here should be read as a statement about what a Passport identifies.

Response headers

What this origin sets on every response

Set in source and applied at the origin rather than only at an edge, because the origin is reachable on its own platform hostname and headers configured only at the edge would leave that path bare.

Content-Security-Policy: default-src 'self', with scripts and styles limited to this origin plus the inline bootstrap Next.js requires. 'unsafe-eval' is absent. Images may come from this origin and from the ECZ-ID badge API, named as an exact origin and never as a wildcard. connect-src is 'self'.
Strict-Transport-Security: Two years, subdomains included, and deliberately NOT preload: submitting a domain to the preload list is slow to reverse and is an explicit decision for the operator, not a side effect of a config file.
X-Frame-Options and frame-ancestors: DENY and 'none'. Nothing on this property should ever be framed by another site.
Referrer-Policy: strict-origin-when-cross-origin, so a link leaving this site carries the origin and never the path.
Permissions-Policy: Camera, microphone, geolocation, payment and USB are all disabled. This site needs none of them.
X-Content-Type-Options: nosniff.

Build-time

A production build refuses a handoff that goes nowhere

A link that silently degrades to a placeholder is invisible until a real operator clicks it, which is the worst possible moment to find out.

The allowlist is enumerated

Every estate destination is checked against a named list of hosts rather than a wildcard on the domain. A wildcard would admit any subdomain someone managed to stand up, and a control pointing at an unexpected host is indistinguishable from a hijacked one.

Availability cannot half-apply

The one configuration value that opens or pauses a family’s door is parsed strictly. A malformed value fails the production build outright rather than applying some of its entries, because a half-applied change to acquisition is harder to reason about than no change at all.

The useful part

This site holds no identity truth

There is no database here, no account, no session, no intake and no write path of any kind.

Identity state lives on the Resolver and is read-only to the world. Acquisition, payment and entitlement live in TrustOps. Compromising this origin would let someone change what these pages say. It would not let them change, issue, revoke or read a single ECZ-ID.

That is a deliberate property of the architecture rather than a happy accident, and it is why this page is short.

Report anything you find to hello@ecocitizenz.com. Tell us what you did and what you saw; we will come back to you.