chore(csp): Move CSP config from head.html to a dedicated json

amol-anand commented 1 year ago

Issue

Fixes #238

Description

Moving the CSP config from head.html to a dedicated json in the code that is easy to see what domains are being included.

Advantages:

Easily see and update CSP for various policies
JSON is cached after the first call
Reduces the size of the head.html request that impacts LHS
Lazily loaded before any block scripts are loaded

New

csp.json

Changed

scripts.json

Removed

CSP from head.html

Test URLs

Before (Changes from main): https://main--merative2--hlxsites.hlx.page/
After (Changes from this PR): https://issue-238-csp-update--merative2--hlxsites.hlx.page/

Testing Instruction

Go to all pages that have scripts coming from external sources

PDF viewer
Marketo form
All pages that pull in Launch tags and all the external 3rd party scripts that get added via Launch
you won't see the CSP in the head.html anymore.
But it will be generated in the tag of the page appropriately and is coming from the csp.json endpoint.

aem-code-sync[bot] commented 1 year ago

Hello, I'm Franklin Bot and I will run some test suites that validate the page speed. In case there are problems, just click the checkbox below to rerun the respective action.