ucdavis / payments

Accept and process credit card payments on campus
MIT License
2 stars 3 forks source link

fix up CSP report #273

Open srkirkland opened 4 years ago

srkirkland commented 4 years ago

we are getting tons of log entries about it. I'm not even seeing blocks or any bad info, just tons of empty reports. ex:

{
  "_id": "2fb84729-53c0-44b0-b491-fc044cc72b40",
  "env": "production",
  "host": "keas production [0000-50aa71]",
  "appname": "payments.mvc",
  "apploc": "D:\\home\\site\\wwwroot\\",
  "message": "csp-report",
  "json": {
    "propertiesObject": {
      "report": {
        "_typeTag": "CspReport",
        "BlockedUri": null,
        "DocumentUri": null,
        "OriginalPolicy": null,
        "Referrer": null,
        "ViolatedDirective": null
      },
      "ActionId": "53e67350-b16b-4f75-a930-689d1aac50a4",
      "ActionName": "Payments.Mvc.Controllers.HomeController.CspReport (Payments.Mvc)",
      "User": null,
      "CorrelationId": "367fbc95-9429-4bf5-af95-28a9f8285570",
      "RequestId": "0HM2BS9EFQR77:0000000C",
      "RequestPath": "/csp-report",
      "ConnectionId": "0HM2BS9EFQR77",
      "Source": "Payments.Mvc"
    }
  },
  "jsonPreview": "{\"propertiesObject\":{\"report\":{\"_typeTag\":\"CspReport\",\"BlockedUri\":null,\"DocumentUri\":null,\"Original...",
  "thread": "118",
  "timestamp": "2020-09-01T19:24:23.414Z",
  "inserted": "2020-09-01T19:24:55.2539631Z",
  "level": "WARNING",
  "logType": "app-dotnet",
  "stackify": {
    "queued": "2020-09-01T19:24:26.6828875Z",
    "tooksecs": 28.571,
    "queuedPartition": "Sep011900p2",
    "order": 1,
    "isWebLog": false,
    "appnameid": "05e63380-16b6-e811-bce7-000d3a328e05",
    "appenvid": "f361cf91-5b7f-4aec-981a-9af33a4e711c",
    "envid": 3,
    "timestamp1m": "2020-09-01T19:24:00Z",
    "timestamp5m": "2020-09-01T19:20:00Z",
    "timestamp1h": "2020-09-01T19:00:00Z",
    "timestamp1d": "2020-09-01T00:00:00Z",
    "isprod": true,
    "expiration1d": "9999-12-31T00:00:00"
  },
  "tag": []
}
srkirkland commented 4 years ago

CSP is failing because of google script, passing this

{"csp-report":{"document-uri":"https://payments.ucdavis.edu/","referrer":"","violated-directive":"connect-src","effective-directive":"connect-src","original-policy":"default-src 'self';script-src 'self' https://cdnjs.cloudflare.com https://cdn.jsdelivr.net https://cdn.datatables.net https://code.jquery.com https://stackpath.bootstrapcdn.com https://ajax.aspnetcdn.com https://www.googletagmanager.com https://www.google-analytics.com https://ajax.cloudflare.com 'nonce-pea6ValwGIjf6mv0kG3/i6WOmp1rTUWoQH6TtPXIK3I=';style-src 'self' https://stackpath.bootstrapcdn.com https://use.fontawesome.com https://cdn.datatables.net https://cdnjs.cloudflare.com https://cdn.jsdelivr.net 'nonce-pea6ValwGIjf6mv0kG3/i6WOmp1rTUWoQH6TtPXIK3I=';font-src 'self' data: https://use.fontawesome.com;img-src 'self' https://www.google-analytics.com data: https://secure.gravatar.com;report-uri /csp-report","disposition":"enforce","blocked-uri":"https://www.google-analytics.com/j/collect?v=1&_v=j85&a=739629516&t=pageview&_s=1&dl=https%3A%2F%2Fpayments.ucdavis.edu%2F&ul=en-us&de=UTF-8&dt=Index%20-%20UC%20Davis%20Payments&sd=24-bit&sr=2560x1440&vp=1424x1093&je=0&_u=AACAAUABAAAAAC~&jid=1348016223&gjid=53910015&cid=1678755484.1596065238&tid=UA-125665400-2&_gid=1333722320.1599606865&_r=1&gtm=2ou8q1&z=272252550","line-number":36,"column-number":32,"source-file":"https://www.google-analytics.com/analytics.js","status-code":0,"script-sample":""}}