Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

HttpExtension: allow setup CSP in report only mode #135

Closed
wants to merge 1 commit into from

Conversation

PavelJurasek
Copy link
Contributor

@PavelJurasek PavelJurasek commented Mar 11, 2018

  • bug fix? no
  • new feature? yes
  • BC break? no
  • doc PR: will do if accepted

CSP can now be enabled in report only mode. PR to nette/application will be sent in just a minute.

@dg
Copy link
Member

@dg dg commented Mar 11, 2018

The question is whether it makes sense to use the headers Content-Security-Policy and Content-Security-Policy-Report-Only (with different settings) together?

I think it has, a Report-Only header can be used to test a future revision to a policy without actually deploying it.

@PavelJurasek
Copy link
Contributor Author

@PavelJurasek PavelJurasek commented Mar 11, 2018

This commit allows only one of them to be enabled at a time. But I can actually see a case when I have a CSP policy and I want to experiment with more strict policy via Report only at the same time.

@dg
Copy link
Member

@dg dg commented Mar 11, 2018

It would be better to add something like csp-report or csp-report-only section.

@PavelJurasek
Copy link
Contributor Author

@PavelJurasek PavelJurasek commented Mar 11, 2018

In order to support both of them at the same time? I don't need this functionality at the moment, so maybe opening an issue with this feature description just to keep track of it would be enough for now?

@dg
Copy link
Member

@dg dg commented Mar 11, 2018

It is good to think ahead. Will be possible to implement support for both header in a way that will co-exist with this solution?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants