One-line summary

This changeset adds support for including a CSP report-uri in a certain percentage of pages, so that we can get an idea of whether pages have inappropriate CSP set, but without saturating our logging service, Sentry.

NB: the relevant config to enable this on Dev, Stage and Prod will be in a separate PR, and that work needs to be merged to make this changeset do anything.

Issue / Bugzilla link

Resolves #14451

Testing

I've added a script called seek_csp_report_uri.py which we can use to check the proportion of headers being set, either locally or on an actual server.

Here's some testing I've done with it:

With CSP_REPORT_PERCENTAGE not set as an env var

[steve] ~/Code/bedrock $ ./bin/manual_qa/seek_csp_report_uri.py http://localhost:8000/en-US/ 100
Checking http://localhost:8000/en-US/
100 requests made
defaultdict(<class 'int'>, {'report-uri not present': 100})

With CSP_REPORT_PERCENTAGE set to 0.005 (which is what we'd start with in production)

Checking http://localhost:8000/en-US/
1000 requests made
defaultdict(<class 'int'>, {'report-uri not present': 995, 'report-uri present': 5})

On mozorg-demo-8 with CSP_REPORT_PERCENTAGE set to 0.75:

[steve] ~/Code/bedrock $ ./bin/manual_qa/seek_csp_report_uri.py https://www-demo8.allizom.org/en-US/ 100
Checking https://www-demo8.allizom.org/en-US/
100 requests made
defaultdict(<class 'int'>, {'report-uri present': 74, 'report-uri not present': 26})

On pocket-demo-4 with CSP_REPORT_PERCENTAGE not set:

[steve] ~/Code/bedrock $ ./bin/manual_qa/seek_csp_report_uri.py https://www-demo4.tekcopteg.com/en-US/ 100                                       [14451-csp-fractional-reporting]
Checking https://www-demo4.tekcopteg.com/en-US/
100 requests made
defaultdict(<class 'int'>, {'report-uri not present': 100})

If you want to do the same

• Pull this branch
• Install kent-server (a fake Sentry from @willkg) with pipx install kent) and run it in it own shell: kent-server run -p 8011
• in your .env file set:

CSP_REPORT_URI=http://public@127.0.0.1:8011/1/security
CSP_REPORT_PERCENTAGE="0.55"  # 55% of requests get the report-uri in the CSP header

• Start your runserver in a separate shell
• In a third shell, run the script to check your localhost's headers 200 times: ./bin/manual_qa/seek_csp_report_uri.py http://localhost:8000/en-US/ 200 and look at the results