Enforce CSP #551
Merged
Enforce CSP #551
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
A live preview of this PR will be available at the URL(s) below. https://pr551-f6d47fc---lit-dev-5ftespv5na-uc.a.run.app/ |
|
Why did the second build fail to deploy a preview site? |
Because NPM has been down this morning. Retrying now, since I think things are back up. |
Now back up! |
AndrewJakubowicz
approved these changes
Oct 7, 2021
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Switches our Content Security Policy from report-only mode to enforced mode.
According to our internal dashboard, it looks like CSP violation numbers dropped very sharply on October 1, which is the day #540 landed. There do seem to be a few reports coming in as recently as October 5, but if so it is a very small number. Could be due to caching? Browser extensions injecting scripts/images etc. will also cause ongoing CSP violations, that's expected behavior.
Also adds
https://www.googletagmanager.comto theimg-srcdirective, since https://developers.google.com/tag-manager/web/csp documents that this is needed, and in one page load I did actually see a violation here in local dev mode (but not consistently -- I can't reproduce it now). I guess analytics sometimes uses images for some reason.Fixes #517
Filed #550 to track the most important improvement, which we can't do until https://bugs.chromium.org/p/chromium/issues/detail?id=1253267 is fixed.