darkhelm/notifications-admin
1
0
Fork 0
mirror of https://github.com/GSA/notifications-admin.git synced 2026-09-08 08:28:15 -04:00
Code Issues Packages Projects Releases Wiki Activity

Serve video from a domain that doesn’t set cookies

Browse Source 
Then it’s one less cookie we have to get users to opt in to. We don’t
derive any value from Youtube setting cookies.

`youtube-nocookie.com` is a domain provided by Google for this purpose.
This commit is contained in:
Chris Hill-Scott
2019-12-19 13:43:44 +00:00
parent 1925f78cec
commit eb87548632
3 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
app/__init__.py
View File

@@ -558,7 +558,7 @@ def useful_headers_after_request(response):
"object-src 'self';" "object-src 'self';"
"font-src 'self' {asset_domain} data:;" "font-src 'self' {asset_domain} data:;"
"img-src 'self' {asset_domain} *.google-analytics.com *.notifications.service.gov.uk {logo_domain} data:;" "img-src 'self' {asset_domain} *.google-analytics.com *.notifications.service.gov.uk {logo_domain} data:;"
"frame-src 'self' www.youtube.com;".format( "frame-src 'self' www.youtube-nocookie.com;".format(
asset_domain=current_app.config['ASSET_DOMAIN'], asset_domain=current_app.config['ASSET_DOMAIN'],
logo_domain=get_logo_cdn_domain(), logo_domain=get_logo_cdn_domain(),
) )

2
app/templates/views/signedout.html
View File

@@ -110,7 +110,7 @@
</h2> </h2>
<div class="responsive-embed responsive-embed--16by9 responsive-embed--bordered bottom-gutter-2"> <div class="responsive-embed responsive-embed--16by9 responsive-embed--bordered bottom-gutter-2">
<div class="responsive-embed__wrapper"> <div class="responsive-embed__wrapper">
<iframe width="560" height="315" src="https://www.youtube.com/embed/_90cv1YgQo4" frameborder="0" allowfullscreen></iframe> <iframe width="560" height="315" src="https://www.youtube-nocookie.com/embed/_90cv1YgQo4" frameborder="0" allowfullscreen></iframe>
</div> </div>
</div> </div>
</div> </div>

4
tests/app/main/views/test_headers.py
View File

@@ -21,7 +21,7 @@ def test_owasp_useful_headers_set(
"font-src 'self' static.example.com data:;" "font-src 'self' static.example.com data:;"
"img-src " "img-src "
"'self' static.example.com *.google-analytics.com *.notifications.service.gov.uk static-logos.test.com data:;" "'self' static.example.com *.google-analytics.com *.notifications.service.gov.uk static-logos.test.com data:;"
"frame-src 'self' www.youtube.com;" "frame-src 'self' www.youtube-nocookie.com;"
) )
@@ -43,5 +43,5 @@ def test_headers_non_ascii_characters_are_replaced(
"font-src 'self' static.example.com data:;" "font-src 'self' static.example.com data:;"
"img-src " "img-src "
"'self' static.example.com *.google-analytics.com *.notifications.service.gov.uk static-logos??.test.com data:;" "'self' static.example.com *.google-analytics.com *.notifications.service.gov.uk static-logos??.test.com data:;"
"frame-src 'self' www.youtube.com;" "frame-src 'self' www.youtube-nocookie.com;"
) )