pleroma/pleroma-fe
0
0
Fork 0
Code Issues 343 Pull requests 27 Projects Releases Packages Wiki Activity

Add Content-Security-Policy header #2123

Closed
tae wants to merge 0 commits from gitlab-mr-iid-856 into develop
pull from: gitlab-mr-iid-856
merge into: pleroma:develop
Conversation 7 Commits - Files changed -
tae commented 2019-06-25 17:20:52 +00:00
Member
Copy link

Now dev testing can reproduce the security issues we saw in production.

Now dev testing can reproduce the security issues we saw in production.
kaniini commented 2019-06-28 00:25:28 +00:00
Member
Copy link

looks ok to me

looks ok to me
hj commented 2019-06-28 09:14:10 +00:00
Owner
Copy link

i don't really understand why tho

i don't really understand why tho
feld commented 2019-07-05 16:22:46 +00:00
Owner
Copy link

It's really painful when devs spend time working on things and then they submit an MR and everything looks OK but you get security issues breaking the change/feature in production because the CSP headers are denying things that nobody saw in dev. The sooner the devs can catch these errors the better, I think.

It's really painful when devs spend time working on things and then they submit an MR and everything looks OK but you get security issues breaking the change/feature in production because the CSP headers are denying things that nobody saw in dev. The sooner the devs can catch these errors the better, I think.
feld commented 2019-07-10 16:06:33 +00:00
Owner
Copy link

I just had a new feature testing in mfc-develop which was great until i deployed it to dev server and got a white screen because CSP violation that developer did not see because it was never deployed to a production Pleroma instance with the CSP headers enabled...

edit: merged this into mfc-develop branch for our use, but I encourage us to do this upstream as well so these issue can be caught as early as possible in the development process

I just had a new feature testing in `mfc-develop` which was great until i deployed it to dev server and got a white screen because CSP violation that developer did not see because it was never deployed to a production Pleroma instance with the CSP headers enabled... edit: merged this into `mfc-develop` branch for our use, but I encourage us to do this upstream as well so these issue can be caught as early as possible in the development process
hj commented 2019-07-10 16:13:39 +00:00
Owner
Copy link

I get the feeling your broken feature used something weird like iframe from another domain which we most likely wouldn't accept upstream...

Still, real solution would be (optional) copying CSP headers from BE since those could change on BE side or instance in question might have its own CSP headers defined in nginx - the old way.

I get the feeling your broken feature used something weird like iframe from another domain which we most likely wouldn't accept upstream... Still, real solution would be (optional) copying CSP headers from BE since those could change on BE side or instance in question might have its own CSP headers defined in nginx - the old way.
shpuld commented 2019-07-10 16:26:44 +00:00
Owner
Copy link

I see no harm in having strict ones in the FE by default

I see no harm in having strict ones in the FE by default
hj commented 2019-07-10 18:40:46 +00:00
Owner
Copy link

i mean sure, i just wanted to know why

i mean sure, i just wanted to know why

Pull request closed

Please reopen this pull request to perform a merge.
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
BE Request

   
Backlog

   
Better behavior

   
Blocked by deps

   
Bug

   
Code Review

   
Discussion

   
Doing

   
Feature Request / Enhancement

   
In the shining bright future maybe

   
It's complicated

   
MS Edge

   
Mememoon (or other niche browsers)

   
Missing API

   
Missing feature

   
Missing l10n/i18n

   
NL1

Instance Admin Dashboard

  
NL2

Improved Mobile Experience

  
NL4

Improved instance customization and QoL options

  
Need to verify on develop

   
RELEASE BLOCKER

   
Reassign or Close

   
Refactor

   
Regression

   
Safari

   
To Do

   
User story

   
Waiting on godot

   
accessibility

https://git.pleroma.social/pleroma/pleroma-fe/-/snippets/7746

  
better documentation

   
chore

   
confirmed

   
easy ticket

   
incident

Denotes a disruption to IT services and the associated issues require immediate attention

  
l10n update

   
mastoapi

   
mobile

   
needs design

   
needs-info

   
needs-review

   
stupid
No labels
BE Request
Backlog
Better behavior
Blocked by deps
Bug
Code Review
Discussion
Doing
Feature Request / Enhancement
In the shining bright future maybe
It's complicated
MS Edge
Mememoon (or other niche browsers)
Missing API
Missing feature
Missing l10n/i18n
NL1
NL2
NL4
Need to verify on develop
RELEASE BLOCKER
Reassign or Close
Refactor
Regression
Safari
To Do
User story
Waiting on godot
accessibility
better documentation
chore
confirmed
easy ticket
incident
l10n update
mastoapi
mobile
needs design
needs-info
needs-review
stupid
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
5 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
pleroma/pleroma-fe!2123
No description provided.