feat: Middleware to add Content-Security-Policy headers #289
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
**Note:** This commit will fail tests, as edx-toggles has not been added to the requirements (it would create a circular dependency) and there is still a module reference to edx-arch-experiments. This is a straight copy of the Python from <edx/edx-arch-experiments#256>. Also: - Add missing changelog entry - Remove outdated note about pinned dependency (was unpinned in 7c9d5af)
- Remove toggle; we can't import edx-toggles, and having One More Thing to remember to configure is probably just too much complexity for deployment. The risk of "I think I turned it on, but I don't see reports" and then making a bad policy change as a result is worse than "oops, I deployed a bad policy and overwhelmed the reporting server". - Remove validation of report-to name. Just give general guidance, and people can read the spec if they want to use a weird name. - Update module reference in tests. - Fix docstring for `CSP_REPORTING_URI`, which I had failed to update after copy-pasting.
timmc-edx
commented
Apr 7, 2023
4 tasks
|
Tests were passing before the previous two commits, but now there's something badly wrong with the codecov package (https://pypi.org/project/codecov/) and CI is broken. But |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This replaces edx/edx-arch-experiments#256 and removes some features. First commit is a straight copy of the Python (plus a couple of unrelated fixes), second commit contains unreviewed changes.
Merge checklist: