security(frontend): ocultar el origen del indexer con proxy same-origin /api + CSP endurecido [P2]

[David1984TK]

Descripción

Categoría: Ciberseguridad — Prioridad 2 (ocultar la dirección del API)

Cada request del navegador (GET/POST/SSE) exponía el origen real del indexer. Con un rewrite de Vercel, el sitio puede servir el API bajo su propio dominio (bimex.mx/api/...): el proxy hacia el indexer ocurre del lado del servidor y la dirección real del backend desaparece del tráfico del navegador.

Nota honesta de alcance: los paths (/api/proyectos, /api/faucet) siguen siendo visibles en DevTools — eso es inherente a cualquier app web; lo que se oculta es el host real del backend, que es lo accionable.

Cambios

• bimex-frontend/vercel.json:
  • Rewrite /api/:path* → indexer (host placeholder TU-INDEXER.example.com a reemplazar al activar).
  • CSP: se agrega upgrade-insecure-requests — cualquier subrecurso http:// accidental se eleva a HTTPS antes de salir del navegador (endurecimiento de URL del sitio).
• bimex-frontend/.env.example: instrucciones para producción (VITE_INDEXER_URL=/api). No requiere cambios de código: todos los consumidores (REST, SSE, subida IPFS del 🔒 security: mover subida a Pinata a proxy backend, quitar secret del bundle #217) ya construyen URLs desde esa env var, y connect-src 'self' del CSP cubre rutas relativas.

Verificación

• vercel.json validado como JSON
• Sin cambios de código ejecutable — el rewrite es opt-in vía env var; hasta activarlo todo sigue funcionando como hoy
• Tests (no aplica)

Notas para el revisor

Activación (2 pasos, cuando gustes): (1) reemplazar el host placeholder del rewrite por el host real del indexer, (2) poner VITE_INDEXER_URL=/api en las env vars de Vercel. Beneficio extra: se puede endurecer el CORS del indexer para aceptar solo el proxy. Caveat conocido: SSE a través del proxy de Vercel tiene límites de duración de conexión — si molesta en la práctica, /sse puede quedarse apuntando directo y el resto pasar por /api.

Sobre "URL del sitio más segura": HSTS con preload ya está configurado desde #111. Dos pasos manuales que no puedo hacer desde aquí: enviar el dominio a hstspreload.org y verificar en el dashboard de Vercel que el dominio canónico redirige (www → apex, http → https).

[Joseph-1-Duro]

@Joseph-1-Duro has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

Hi, I would love to work on your project.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Joseph-1-Duro to this issue.

[Caneryy]

@Caneryy has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

Hi, can I work on this issue?

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Caneryy to this issue.

[drips-wave]

Congratulations, @Caneryy! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on July 30, 2026.

🧑‍💻 @Caneryy: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.

Warning

When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.

🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.

🌊 Happy Wave 🌊

[drips-wave]

This issue has been completed by @Caneryy as part of the Stellar Wave Program's 7th Wave 🥳

😎 @Caneryy: You earned 200 Points for completing this issue! After the current Wave ends, you'll be eligible for a percentage of the Wave's reward pool based on the percentage of total points you've earned. Learn more here. You can also Leave a review to share your experience working on this issue.

🧑‍💻 Repo maintainers: How'd the contributor do? Leave a review to share your experience working with them.