Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

HttpExtension: allow setup CSP in report only mode #135

Closed
wants to merge 1 commit into from

Conversation

@PavelJurasek
Copy link
Contributor

PavelJurasek commented Mar 11, 2018

  • bug fix? no
  • new feature? yes
  • BC break? no
  • doc PR: will do if accepted

CSP can now be enabled in report only mode. PR to nette/application will be sent in just a minute.

PavelJurasek added a commit to PavelJurasek/application that referenced this pull request Mar 11, 2018
…fallback, related nette/http#135
PavelJurasek added a commit to PavelJurasek/application that referenced this pull request Mar 11, 2018
…fallback, related nette/http#135
@dg

This comment has been minimized.

Copy link
Member

dg commented Mar 11, 2018

The question is whether it makes sense to use the headers Content-Security-Policy and Content-Security-Policy-Report-Only (with different settings) together?

I think it has, a Report-Only header can be used to test a future revision to a policy without actually deploying it.

@PavelJurasek

This comment has been minimized.

Copy link
Contributor Author

PavelJurasek commented Mar 11, 2018

This commit allows only one of them to be enabled at a time. But I can actually see a case when I have a CSP policy and I want to experiment with more strict policy via Report only at the same time.

@dg

This comment has been minimized.

Copy link
Member

dg commented Mar 11, 2018

It would be better to add something like csp-report or csp-report-only section.

@PavelJurasek

This comment has been minimized.

Copy link
Contributor Author

PavelJurasek commented Mar 11, 2018

In order to support both of them at the same time? I don't need this functionality at the moment, so maybe opening an issue with this feature description just to keep track of it would be enough for now?

@dg

This comment has been minimized.

Copy link
Member

dg commented Mar 11, 2018

It is good to think ahead. Will be possible to implement support for both header in a way that will co-exist with this solution?

@dg dg closed this in edc6e04 Mar 14, 2018
dg added a commit that referenced this pull request Mar 14, 2018
…same time [Closes #136][Closes #135]
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
2 participants
You can’t perform that action at this time.