Use the content security policy addon for new applications.

[rwjblue]

Closes #1705.

Excerpts from the repos README:

---

This addon adds the Content-Security-Policy header to response sent from the Ember CLI Express server. Clearly, Ember CLI is not intended for production use, and neither is this addon. This is intended as a tool to ensure that CSP is kept in the forefront of your thoughts while developing an Ember application.

Options

This addon is configured via your applications config/environment.js file. Two specific properties are used from your projects configuration:

• contentSecurityPolicyHeader -- The header to use for CSP (default: Content-Security-Policy)
• contentSecurityPolicy -- This is an object that is used to build the final header value. Each key/value in this object is converted into a key/value pair in the resulting header value.

The default contentSecurityPolicy value (if you do not override in your config/environment.js) is:

  contentSecurityPolicy: {
    'default-src': 'none',
    'script-src': 'self',
    'connect-src': 'self',
    'img-src': 'self',
    'style-src': 'self'
  }

Which is translated into:

default-src 'none'; script-src 'self'; connect-src 'self'; img-src 'self'; style-src 'self';

Please note, that when running ember serve with live reload enabled, we also add the liveReloadPort to the connect-src whitelist.

[thejchap]

After doing a diff of 0.46 ember init to master ember init and updating stuff accordingly I am getting Refused to load the script 'http://localhost:4200/assets/ui.js' because it violates the following Content Security Policy directive: "script-src self". with the default CSP values suggested in the readme @ https://github.com/rwjblue/ember-cli-content-security-policy.....am I missing something here?

environment.js:

...
ENV.APP.contentSecurityPolicy = {
  'default-src': 'none',
  'script-src': 'self',
  'connect-src': 'self',
  'img-src': 'self',
  'style-src': 'self'
};
...

[rwjblue]

@thejchap - First, that is the default, so you don't have to do anything. Second, the readme is wrong (realized it this morning and release 0.1.3 of the package to fix). It should be (note that self and none are quoted):

contentSecurityPolicy: {
        'default-src': "'none'",
        'script-src': "'self'",
        'connect-src': "'self'",
        'img-src': "'self'",
        'style-src': "'self'"
      }

[thejchap]

@rwjblue Roger that. Thanks!