Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Feat: Implement strict Content Security Policy #1358

Merged
merged 6 commits into from
Apr 20, 2023
Merged

Feat: Implement strict Content Security Policy #1358

merged 6 commits into from
Apr 20, 2023

Commits on Apr 13, 2023

  1. feat(settings): enforce strict Content Security Policy 

    * disallow base-uri
* disallow object-src
* disallow unsafe-inline for script-src
* require nonce for script-src
    @thekaveman
    thekaveman committed Apr 13, 2023
    Configuration menu
    Copy the full SHA
    6c65db8 View commit details
    Browse the repository at this point in the history

  2. chore: implement nonce on <script> tags

    @thekaveman
    thekaveman committed Apr 13, 2023
    Configuration menu
    Copy the full SHA
    9b20fa7 View commit details
    Browse the repository at this point in the history

  3. chore(analytics): add nonce to inject <script> tag

    @thekaveman
    thekaveman committed Apr 13, 2023
    Configuration menu
    Copy the full SHA
    ad9730d View commit details
    Browse the repository at this point in the history

  4. chore(enrollment): add nonce to payment processor script 

    use the more generic $.ajax() to download the script and apply the nonce
before execution
    @thekaveman
    thekaveman committed Apr 13, 2023
    Configuration menu
    Copy the full SHA
    24d954f View commit details
    Browse the repository at this point in the history

  5. feat(sentry): support CSP report-uri directive 

    sentry has out of the box support for receiving CSP reports
https://docs.sentry.io/product/security-policy-reporting/
    @thekaveman
    thekaveman committed Apr 13, 2023
    Configuration menu
    Copy the full SHA
    2faabec View commit details
    Browse the repository at this point in the history

Commits on Apr 14, 2023

  1. docs: strict CSP, Sentry report-uri config

    @thekaveman
    thekaveman committed Apr 14, 2023
    Configuration menu
    Copy the full SHA
    02b5ef9 View commit details
    Browse the repository at this point in the history