Use CSP sandbox

[rugk]

See https://scotthelme.co.uk/csp-cheat-sheet/#sandbox

So what do we need?

• allow-forms
• allow-same-origin
• allow-scripts
• allow-top-navigation
• allow-popups
• allow-pointer-lock

Can you confirm this, @elrido?

[elrido]

I am quite sure we need almost all of them, so the sandbox directive seems quite pointless for our project.

[rugk]

I've already ticked the one we need, …
They should be the minority. At least we do not need the last three.

[elrido]

We do use pop-ups (in the page template).

I suspect that sandboxing would break many of our use cases, as:

The sandbox applies a same origin policy, prevents popups, plugins and script execution is blocked.

Source: https://content-security-policy.com/

This would, among other things, break password managers.

[rugk]

So I could basically confirm your requirements. Popus are required for the page theme (password entry) and forms are required for the password entry in the bootstrap theme.
I could not confirm that it would break password managers (tried it with FF internal one) and I also do not see why it should. Maybe give it a try.