GCTC-NTGC / gc-digital-talent

GC Digital Talent is the new recruitment platform for digital and tech jobs in the Government of Canada. // Talents numériques du GC est la nouvelle plateforme de recrutement pour les emplois numériques et technologiques au gouvernement du Canada.

https://talent.canada.ca

GNU Affero General Public License v3.0

22 stars 9 forks source link

✨ Add `Content-Security-Policy` header to servers #1803

Open gggrant opened 2 years ago

gggrant commented 2 years ago

Currently we just have the old one from TalentCloud commented out in our CI pipelines in Azure.

This should to be updated for gc-digital-talent policies and added to the .htaccess write-out task in each.

Details

After #10614, if we don't see errors, we make the policies strict.

🛑 Blockers

### Blocked By
- [ ] #10420
- [ ] #10614

Acceptance Criteria

[ ] We have strict CSP headers which don't cause any unexpected headers

petertgiles commented 2 years ago

To be added to the htaccess

mnigh commented 1 year ago

To be added to the htaccess

Now that we have moved to nginx, this will be a bit different since nginx does not use .htaccess files.

mnigh commented 10 months ago

@GCTC-NTGC/developers this issue is nearly two years old and our oldest open issue in this repo. do we have any path forward for this or should it be closed?

esizer commented 10 months ago

@GCTC-NTGC/developers this issue is nearly two years old and our oldest open issue in this repo. do we have any path forward for this or should it be closed?

I think we should define the issue a bit more but we really should get this in. It's pretty tedious but is a good idea. Something we could do is setup a very strict report only policy which will report on all resources we need to consider for the policy. The next step would be to review that report (found in the warning console) and apply an appropriate policy to every one. At least, that is how I have approached it in the past.

petertgiles commented 5 months ago

I've tried to create a focused first step: 10420

github-actions[bot] commented 3 months ago

Status: Ready to merge :heavy_check_mark:

Issues blocking this PR:

10420 :heavy_check_mark:
10614 :heavy_check_mark:

This comment was automatically written by the Blocking Issues bot, and this PR will be monitored for further progress.

esizer commented 1 month ago

Our next release will start reporting violations in our logs (assuming no issues are found and we don't need to rollback the headers).

Do we want to set a date to review violations to determine if we can move forward on this now?