ember-cli / ember-cli.github.io

Our documentation site
13 stars 99 forks source link

Docs incorrectly state the ember-cli-content-security-policy addon is bundled #160

Closed localpcguy closed 6 years ago

localpcguy commented 7 years ago

Changelog shows it was removed after v1.13.15 (not due to anything wrong with the addon)

ember-cli-content-security-policy has been removed from the default project blueprint due to extremely poor ergonomics. If the addon is working well for you, please continue to use it.

https://github.com/ember-cli/ember-cli/blob/master/CHANGELOG.md#changes-since-11315

From the current Docs:

Content Security Policy

Ember CLI comes bundled with the ember-cli-content-security-policy addon which when running the development server, enables Content Security Policy in modern browsers. When enabled, Content Security Policy mitigates certain types of attacks including Cross Site Scripting (XSS) and data injection. While browser support is not yet universal, Ember CLI makes it easy to build your app with CSP in mind. For example, enabling it on your production stack is as simple as adding these headers.

I'll submit a PR updating the section saying it isn't installed and telling users where to look for the addon. That way someone looking for information on Content Security Policies can still find the reference in the docs. If the preference is to just completely remove the reference, let me know.

locks commented 6 years ago

Fixed by linked PR.