Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[CPDNPQ-2485] make content security policy more secure #2170

Closed
wants to merge 4 commits into from
Closed

[CPDNPQ-2485] make content security policy more secure #2170

wants to merge 4 commits into from

Conversation

alkesh
Copy link
Contributor

@alkesh alkesh commented Feb 3, 2025 •
edited
Loading

Context

Ticket: https://dfedigital.atlassian.net/browse/CPDNPQ-2485

Current CSP needs improvements:

  • remove unsafe-inline and unsafe-eval for scripts
  • replace use of <script> with nonced_javascript_tag in the views
  • remove unsafe-inline for styles
  • change report_uri to report to sentry
  • remove CSP reports controller and route
  • fix javascript console error that was only occurring on separation admin (every page)

⚠️ deploy to the review app is failing on this branch ⚠️

@alkesh alkesh changed the title [CPDNPQ-2485] make content security policy more secuire [CPDNPQ-2485] make content security policy more secure Feb 3, 2025
@alkesh alkesh force-pushed the CPDNPQ-2485-content-security-policy branch 2 times, most recently from 1cd52cc to 496e79c Compare February 3, 2025 15:32
@github-actions GitHub Actions
Copy link
Contributor

github-actions bot commented Feb 3, 2025

Review app deployed to https://npq-registration-review-2170-web.test.teacherservices.cloud/

@alkesh alkesh force-pushed the CPDNPQ-2485-content-security-policy branch from 6d4b563 to 9e3e1a9 Compare February 4, 2025 10:00
@alkesh alkesh force-pushed the CPDNPQ-2485-content-security-policy branch from 83fa9c0 to b164ffd Compare February 4, 2025 11:28
@alkesh alkesh force-pushed the CPDNPQ-2485-content-security-policy branch from b164ffd to ed19f0d Compare February 4, 2025 14:22
@alkesh alkesh force-pushed the CPDNPQ-2485-content-security-policy branch from ed19f0d to 931bafb Compare February 4, 2025 14:49
@alkesh alkesh force-pushed the CPDNPQ-2485-content-security-policy branch from 931bafb to f20b641 Compare February 4, 2025 15:22
@alkesh alkesh closed this Feb 4, 2025
@alkesh alkesh reopened this Feb 4, 2025
@alkesh alkesh force-pushed the CPDNPQ-2485-content-security-policy branch from f20b641 to c4fb6e6 Compare February 4, 2025 17:01
@sonarqubecloud SonarQubeCloud
Copy link

sonarqubecloud bot commented Feb 5, 2025

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

@alkesh alkesh closed this Feb 5, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@alkesh