darkhelm/notifications-admin
1
0
Fork 0
mirror of https://github.com/GSA/notifications-admin.git synced 2026-08-18 05:29:38 -04:00
Code Issues Packages Projects Releases Wiki Activity

Fix content security policy for the CDN

Browse Source 
The CDN URLs aren’t in included in the content security policy. So
browsers will refuse to load them.

This commit:
- adds each of the CDN URLs to the
- only prepend URLs in CSS files with `/static/` if we’re running
  locally (because the CDN URLs are like `static.example.com` not
  `example.com/static`)
This commit is contained in:
Chris Hill-Scott
2018-11-29 11:29:52 +00:00
parent 74459b2f2a
commit fe6610c221
4 changed files with 31 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
app/__init__.py
View File

@@ -496,17 +496,24 @@ def save_service_or_org_after_request(response):
# https://www.owasp.org/index.php/List_of_useful_HTTP_headers
def useful_headers_after_request(response):
notify_environment = os.environ['NOTIFY_ENVIRONMENT']
response.headers.add('X-Frame-Options', 'deny')
response.headers.add('X-Content-Type-Options', 'nosniff')
response.headers.add('X-XSS-Protection', '1; mode=block')
response.headers.add('Content-Security-Policy', (
"default-src 'self' 'unsafe-inline';"
"script-src 'self' *.google-analytics.com 'unsafe-inline' 'unsafe-eval' data:;"
"default-src 'self' {} 'unsafe-inline';"
"script-src 'self' {} *.google-analytics.com 'unsafe-inline' 'unsafe-eval' data:;"
"connect-src 'self' *.google-analytics.com;"
"object-src 'self';"
"font-src 'self' data:;"
"img-src 'self' *.google-analytics.com *.notifications.service.gov.uk {} data:;"
"frame-src 'self' www.youtube.com;".format(get_cdn_domain())
"font-src 'self' {} data:;"
"img-src 'self' {} *.google-analytics.com *.notifications.service.gov.uk {} data:;"
"frame-src 'self' www.youtube.com;".format(
configs[notify_environment].ASSET_DOMAIN,
configs[notify_environment].ASSET_DOMAIN,
configs[notify_environment].ASSET_DOMAIN,
configs[notify_environment].ASSET_DOMAIN,
get_cdn_domain(),
)
))
if 'Cache-Control' in response.headers:
del response.headers['Cache-Control']