Chris Hill-Scott 1d10ad2247 Stop content security policy blocking GA ...

In https://github.com/alphagov/notifications-admin/pull/1583 we changed
our Google Analytics settings to use newer browsers’ `sendBeacon`
feature. The advantage of this is that it

> [ensures] that the data has been sent during the unloading of a
> document [which] is something that has traditionally been difficult
> for developers

– https://developer.mozilla.org/en-US/docs/Web/API/Navigator/sendBeacon

To transmit this data it uses a AJAX request (`XMLHttpRequest`)
underneath. AJAX requests are governed by the `connect-src` content
security policy (or the `default-src` if one is not present).
`connect-src`:

> Applies to XMLHttpRequest (AJAX), WebSocket or EventSource. If not
> allowed the browser emulates a 400 HTTP status code.

– https://content-security-policy.com/

Because we didn’t have one in place, `sendBeacon` requests to GA were
getting blocked in browsers that support content security policy (pretty
much everything better than IE11[1]).

1. https://caniuse.com/#feat=beacon

2017-11-06 10:25:30 +00:00

..

app

Stop content security policy blocking GA

2017-11-06 10:25:30 +00:00

non_spreadsheet_files

…

spreadsheet_files

…

__init__.py

Merge pull request #1598 from gov-cjwaszczuk/master

2017-11-06 10:00:15 +00:00

conftest.py

Merge pull request #1598 from gov-cjwaszczuk/master

2017-11-06 10:00:15 +00:00