Turn on CSP

[magopian]

This is something we keep thinking about, and then forgetting. @muffinresearch care to give a few hints and tips on this one? Advices or pointers on how to do that? Any idea how big a project it is?

[andymckay]

See https://bugzilla.mozilla.org/show_bug.cgi?id=594584 for old information.

[muffinresearch]

The config should already be in place - so it just needs updating based on testing.

The biggest impact will be the potential for blocking something that matters. The best way to deal with that is going to be to turn-it on for real in local dev and maybe addons-dev initially. Look for blocked scripts and iterate on the config until everything works.

Once we have that working we can go to stage and have QA do similar checks. It's going to be a similar process to dealing with jquery-migrate. For that reason we shouldn't do both at the same time.

The only other thing is working out where reports should go - we probably want @amuntner to chime in on that.

[andymckay]

Make sure this works in docker: https://bugzilla.mozilla.org/show_bug.cgi?id=1210633

[jvehent]

FYI, we're working on generalizing the reporting and deduplication pipeline for cloud services. I'd suggest using the same reporting method @Micheletto put in place for Hello, which uses a report URI in Nginx and feeds into Heka. (cc @jasonthomas)

[andymckay]

We ddos'ed ourselves last time due to https://bugzilla.mozilla.org/show_bug.cgi?id=615708. Just so you know.

[jvehent]

@andymckay Are you suggesting that sending reports to the same origin might induce a ddos risk?

[andymckay-limited-access]

It has in the past, which is why it was never turned on. Would like to
avoid that again.

On Thu, Dec 17, 2015 at 10:19 AM, Julien Vehent [:ulfr] <
notifications@github.com> wrote:

@andymckay https://github.com/andymckay Are you suggesting that sending
reports to the same origin might induce a ddos risk?

—
Reply to this email directly or view it on GitHub
https://github.com/mozilla/olympia/issues/995#issuecomment-165536899.

[andymckay]

Tracker #2282

[april]

I'm certainly willing to provide assistance on CSP as well, if anybody has any questions. Just let me know! :)

[muffinresearch]

Here's an etherpad with some qa notes: https://public.etherpad-mozilla.org/p/csp-qa-addons

[muffinresearch]

Ok so latest update the report-only mode is back for another week so we can clear up the last remaining issues.

[ValentinaPC]

This can be marked as verified fixed because all related bugs were verified or superseded.