Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Remove unsafe-inline from CSP #984

Closed
tunetheweb opened this issue Jul 8, 2020 · 1 comment · Fixed by #1010
Closed

Remove unsafe-inline from CSP #984

tunetheweb opened this issue Jul 8, 2020 · 1 comment · Fixed by #1010
Assignees
@tunetheweb
Labels
development Building the Almanac tech stack good first issue Good for newcomers
Milestone
2019 Backlog

Comments

@tunetheweb
Copy link
Member

tunetheweb commented Jul 8, 2020 •
edited
Loading

We allow inline-styles in case Authors want to use them. However few do and in #965 we cleaned them all up to use classes instead.

Should we remove unsafe-inline from our CSP as per best practice?

Or do we think we want to keep the ability to have in-line styles directly in HTML elements?

We still have some <style> code directly in our HTML templates in the <head>, but they are easily handled with a nonce same as we do for scripts:

So, from this:

<style>
...
</style>

to this:

<style nonce="{{ csp_nonce() }}">
...
</style>

And would need to add style-src to our nonce config:

almanac.httparchive.org/src/main.py

Line 30 in db9bc92

content_security_policy_nonce_in=['script-src'])

As we already use this for script-src I think this is safe to do.
@tunetheweb tunetheweb added the development Building the Almanac tech stack label Jul 8, 2020
@tunetheweb tunetheweb added this to the 2019 Backlog milestone Jul 8, 2020
@tunetheweb tunetheweb added the good first issue Good for newcomers label Jul 8, 2020
@rviscomi
Copy link
Member

rviscomi commented Jul 8, 2020

This seems like a good idea

@tunetheweb tunetheweb mentioned this issue Jul 12, 2020
Merged
@tunetheweb tunetheweb self-assigned this Jul 12, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@tunetheweb tunetheweb

Labels
development Building the Almanac tech stack good first issue Good for newcomers
Projects
None yet
Milestone
2019 Backlog
Development

Successfully merging a pull request may close this issue.

Remove inline styles from CSP HTTPArchive/almanac.httparchive.org
2 participants
@rviscomi @tunetheweb