💥 custom CSP will always extend Shopify domain and default development domain

[michenly]

WHY are these changes introduced?

The CSP bug was found when using ngrok as public domain for local development (after #1591)

Without modifying anything you will find the following bug in browser

The fix for this is to modify createContentSecurityPolicy options in app/entry.server.tsx which the user need to add in the public domain they are using follow by all the current defaults manually.

const {nonce, header, NonceProvider} = createContentSecurityPolicy(
  {
    connectSrc: [
        'wss://public-domain:*', 
        'http://localhost:*', 
        'ws://localhost:*', 
        'ws://127.0.0.1:*', 
    ],
  },
);

This is not easy to maintain, specially if the defaults ever change.

WHAT is this pull request doing?

This PR change the behaviour of createContentSecurityPolicy where the custom CSP pass in will no longer override the default domains.

The new behaviour will take the user generated options and add default policies on top of it.

HOW to test your changes?

Post-merge steps

Checklist

• I've read the Contributing Guidelines
• I've considered possible cross-platform impacts (Mac, Linux, Windows)
• I've added a changeset if this PR contains user-facing or noteworthy changes
• I've added tests to cover my changes
• I've added or updated the documentation

[michenly]

I am pretty sure there are many more docs I need to update. Will figure it out soon!

[blittle]

Suggested change

	✨ add applyDefault option to createContentSecurityPolicy which allow use to add policy in front of the existing rules instead of overriding them. The default value of applyDefault option is false which is the current behaviour.
	✨ add `applyDefault` option to `createContentSecurityPolicy` which automatically adds Shopify domains to the content security policy, extending whatever rules are passed instead of overriding them. The default value of `applyDefault` option is false which is the current behavior.

[blittle]

Actually thinking about this more, I think almost always if the user provides a custom CSP, they will probably also want to keep the Shopify domains as well. So perhaps this should be default to true, or inverse it and default it to false. Sure it would be a breaking change, but it's relatively minor, and we can make a breaking change for the 2024-01 release. So now would be the time to do it. Thoughts?

[michenly]

@blittle 👍 true say. Since including Shopify domains really just allow more CSP, nothing should really break.
I will edit and make this PR a breaking change and use extending as the default.