search

Major-League-Summer-Baseball / mlsb-platform

A platform for mlsb
http://mlsb-platform.herokuapp.com/documentation
Apache License 2.0
3 stars 1 forks source link

Flask-Tailsman #121

Open fras2560 opened 3 years ago

fras2560 commented 3 years ago

One security library is Flask-Tailsman. It seems to enforce good security enforcement. However, it seems the current structure of the app would need to be adjust to make it work.

This ticket should aim to use Flask-Tailsman to help improve security of the app.

fras2560 commented 3 years ago

So it seems this library works but just not with CSP enabled.

fras2560 commented 6 months ago

https://github.com/Major-League-Summer-Baseball/mlsb-platform/pull/206

This PR introduces a weak policy that could be used moving forward.

However, for a good policy probably want to:

Going to work through replacing the admin before focusing on this. Admin and documentation have alot of inline style and scripts so replacing them will make things easier.