Give the site a favicon by MRmarioruci · Pull Request #146 · dfinity/imcp2

MRmarioruci · 2026-08-20T10:04:21Z

Summary

The site had no favicon. This adds one

Related issues

None.

Changes

GET /favicon.svg joins site_metadata_router next to /sitemap.xml and
/robots.txt, as image/svg+xml with a day of cache. Each served page then
links it: /, /privacy-policy, /support and /terms in main.rs, and the
pinned callback page plus the shared error screen in auth.rs. Because those two
run default-src 'none', and CSP governs a <link rel=icon> fetch as an image,
each of their headers gains img-src 'self' — this origin's own file and nothing
else; the nonce'd script and style rules are untouched. That is the third commit
on its own, so it drops cleanly if you would rather leave those headers alone.

The landing page carries the link twice. Its bundle unpacks itself by parsing the
embedded template and calling documentElement.replaceWith, which throws away
the shell <head> the Claude Design export ships — icon included — so a copy
rides into the template on the head fragment the unpack routine already splices
the resource map into. The shell copy stays for a crawler running no JavaScript.
A re-export drops both; that is noted on INDEX_HTML.

Testing

cargo build --locked --all-targets
cargo test --locked --all-targets — 204 pass, including two new ones for the route and the page links.
cargo clippy --all-targets — no new warnings. cargo fmt not run: the tree is not rustfmt-default formatted and it would reformat unrelated files.
npm test --prefix monitoring/mcp-status (dashboard unchanged)

Checked against a local cargo run: the route returns the mark with the right
content type and cache header, Chrome fetches it from the link tag, and the
default-src 'none' error screen reports no CSP violation.

Nothing is served at /favicon.ico, so a browser without SVG-icon support falls
back to its default glyph. forumic.com also ships favicon.ico,
apple-touch-icon.png and safari-pinned-tab.svg if we want that coverage.

Checklist

I have read the Contributing guidelines.
Docs (README / comments) updated for any user-visible change.
No secrets, credentials, or internal-only information are included.

🤖 Generated with Claude Code

Copilot

Pull request overview

Adds Internet Identity’s SVG favicon across all site and authentication pages.

Changes:

Serves cacheable /favicon.svg.
Links the favicon from every HTML page.
Updates strict CSPs to permit same-origin image loading.

Reviewed changes

Copilot reviewed 9 out of 10 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
`src/main.rs`	Adds the favicon route and tests.
`src/auth.rs`	Updates authentication-page CSPs and tests.
`src/assets/favicon.svg`	Adds the favicon asset.
`src/assets/index.html`	Preserves the icon through document replacement.
`src/assets/privacy-policy.html`	Links the favicon.
`src/assets/support.html`	Links the favicon.
`src/assets/terms.html`	Links the favicon.
`src/assets/connect-callback.html`	Links the favicon.
`src/assets/connect-error.html`	Links the favicon.
`README.md`	Documents favicon availability.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Copilot

Pull request overview

Copilot reviewed 9 out of 10 changed files in this pull request and generated no new comments.

Suppressed comments (2)

src/auth.rs:1488

This security description is inaccurate: img-src 'self' permits any same-origin URL as an image source, not exactly /favicon.svg. The narrower fact is that this page currently declares only the favicon; documenting that distinction avoids overstating the CSP restriction.

    // `img-src 'self'` admits exactly one thing: the origin's own `/favicon.svg`,
    // which browsers fetch for the `<link rel=icon>` in the head and which CSP
    // governs as an image. Same-origin only, so it opens no path off this server;
    // without it the tab renders the browser's default glyph mid-connect.

src/main.rs:178

The public McpServer::mcp_router() serves these connect pages to embedders, but /favicon.svg is only defined by this binary's private site_metadata_router. Consumers following the embedding contract in src/lib.rs:239-258 therefore get a guaranteed 404 for the new subresource. Please serve the icon from a reusable/prefixed library route, expose an asset router, or avoid adding the link to library-owned templates.

/// The connect screens in `auth.rs` link the same root-absolute `/favicon.svg`,
/// so an embedder that mounts the MCP router without `site_metadata_router` just
/// gets the browser's default glyph there.

The site had no favicon, so every page — the landing page, the policy documents, and the connect screens — rendered with the browser's default glyph. The icon is the full-colour ICP infinity mark, taken byte-identical from forumic.com, which already shares this site's palette. SVG rather than a raster `.ico`: it is 2 KB at every size, and it sits on transparency, so the browser's own chrome carries it in either theme and no light/dark variant is needed. It joins `site_metadata_router` alongside `/sitemap.xml` and `/robots.txt`, served as `image/svg+xml` with a day of cache. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

`/`, `/privacy-policy`, `/support` and `/terms` each get a `<link rel=icon>` pointing at the new route. The landing page needs the link twice. Its bundle unpacks itself by parsing the embedded template and calling `documentElement.replaceWith`, which discards the shell `<head>` the export ships — icon included — so a copy has to ride into the template on the same head fragment the unpack routine already splices the resource map into. The shell copy stays because that is what a crawler running no JavaScript reads. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

The pinned callback page and the shared error screen link the icon like every other page, but both run `default-src 'none'`, under which CSP governs a `<link rel=icon>` fetch as an image and drops it. Each gains `img-src 'self'`, which admits this origin's own `/favicon.svg` and nothing else; the nonce'd script and style rules are untouched. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Copilot

Pull request overview

Copilot reviewed 8 out of 9 changed files in this pull request and generated no new comments.

Suppressed comments (2)

src/auth.rs:1493

The new favicon fetch makes the function's security contract stale: lines 1395–1398 still say connect-src is the page's only network reach and that default-src 'none' forbids everything else. Please document this same-origin image exception so future CSP changes are assessed against the actual policy.

         img-src 'self'; connect-src 'self'; base-uri 'none'; form-action 'none'; \

src/auth.rs:1601

This exception contradicts error_screen's rustdoc, which says the nonce'd style is the only allowed inline/resource content and everything else is denied. Update the contract to mention the same-origin favicon so the documented CSP matches the response.

        "default-src 'none'; style-src 'nonce-{nonce}'; img-src 'self'; base-uri 'none'; \

MRmarioruci requested a balanced review from Copilot August 20, 2026 10:16

MRmarioruci marked this pull request as ready for review August 20, 2026 10:16

MRmarioruci requested review from a team and aterga August 20, 2026 10:16

Copilot started reviewing on behalf of MRmarioruci August 20, 2026 10:16 View session

Copilot AI reviewed Aug 20, 2026

View reviewed changes

Comment thread src/auth.rs Outdated

Copilot AI review requested due to automatic review settings August 20, 2026 11:44

MRmarioruci force-pushed the claude/mcp-site-favicon-c262af branch from 379fadb to 3327247 Compare August 20, 2026 11:44

Copilot started reviewing on behalf of MRmarioruci August 20, 2026 11:45 View session

MRmarioruci marked this pull request as draft August 20, 2026 11:45

Copilot AI reviewed Aug 20, 2026

View reviewed changes

aterga previously approved these changes Aug 20, 2026

View reviewed changes

MRmarioruci and others added 3 commits August 20, 2026 13:53

MRmarioruci dismissed aterga’s stale review via 9857050 August 20, 2026 11:55

MRmarioruci force-pushed the claude/mcp-site-favicon-c262af branch from 3327247 to 9857050 Compare August 20, 2026 11:55

MRmarioruci marked this pull request as ready for review August 20, 2026 11:58

Copilot AI review requested due to automatic review settings August 20, 2026 11:58

Copilot started reviewing on behalf of MRmarioruci August 20, 2026 11:59 View session

Copilot AI reviewed Aug 20, 2026

View reviewed changes

MRmarioruci requested a review from aterga August 20, 2026 12:10

aterga approved these changes Aug 20, 2026

View reviewed changes

MRmarioruci merged commit 189fabd into main Aug 20, 2026
8 checks passed

Navigation Menu

Uh oh!

Give the site a favicon - #146

Give the site a favicon#146
MRmarioruci merged 3 commits into
mainfrom
claude/mcp-site-favicon-c262af

MRmarioruci commented Aug 20, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

MRmarioruci commented Aug 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Related issues

Changes

Testing

Checklist

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

MRmarioruci commented Aug 20, 2026 •

edited

Loading