Closed g-k closed 7 years ago
r? @jaredkerim
Actually, this might not work if the injected vars in the inline scripts change.
Probably want an upstream patch to use CSP nonce or smarter hash-sources (refs: https://github.com/mozilla/django-csp/issues/48)
Edit: fixed with a810344 and verified the other snippet doesn't differ between local and prod environments so a hash-source is OK there
Looks really good to me! Thanks for this!
Adds a report only CSP header for #302
The report URI doesn't exist yet, but we can add that at the load balancer or reverse proxy level.
To lock this down further in future PRs we can:
The header was generated by proxying through OWASP ZAP with the CSP helper addon to local and prod instances of location leaderboard then manually simplifying the resulting header.