Implement Content Security Policy

[ottok]

The Nginx headers could include Content Security Policy. We just need to research what is the correct parameters to use.

Learn:

• https://en.wikipedia.org/wiki/Content_Security_Policy
• https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP

Validate:

• https://pressjitsu.com/benchmark/?d=191139&h=w2oqe9&results

[simoke]

There are a few things to consider:

• All rules are not compatible with all browsers
• There may be problems with multiple domains, if the domain must be defined as rule parameter
• How to set the domain(s) automatically to all containers, if necessary?

[ottok]

This is a single site, linux-tuki.fi. No need to consider any other sites/containers..

[simoke]

I've now tested with several, more and less strict policies; apparently using any policy causes images and other media content loads to be blocked, and with any browser. I'm going to investigate this more.

[simoke]

Tested with several variations:

add_header Content-Security-Policy "default-src 'self' *.linux-tuki.fi *.wp.seravo.com; media-src *; script-src *";

add_header Content-Security-Policy "default-src 'self' *.linux-tuki.fi *.fi.seravo.com https://google.com https://youtube.com https://facebook.com https://fonts.google.com https://fonts.googleapis.com https://ajax.googleapis.com https://www.google-analytics.com https://cdnjs.cloudflare.com https://code.jquery.com https://connect.facebook.net https://s.imgur.com https://imgur.com https://i.imgur.com https://500px.com https://drscdn.500px.org https://www.reddit.com https://www.flickr.com https://c1.staticflickr.com https://maxcdn.bootstrapcdn.com http://code.ionicframework.com https://cdn.fontawesome.com/;

Also the following lines were applied:

script-src 'self' *.linux-tuki.fi *.fi.seravo.com 'unsafe-inline';
style-src 'self' *.linux-tuki.fi *.fi.seravo.com;
img-src 'self' *.linux-tuki.fi *.fi.seravo.com data:;
connect-src 'self' *.linux-tuki.fi *.fi.seravo.com;
font-src 'self' *.linux-tuki.fi *.fi.seravo.com;
object-src 'none';
media-src 'self' *.linux-tuki.fi *.fi.seravo.com;
form-action 'self' *.linux-tuki.fi *.fi.seravo.com;
frame-ancestors 'self' *.linux-tuki.fi *.fi.seravo.com";

However, the site always refuses to load media content normally.