Skip to content

content security policy audit #1331

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
rBangay merged 5 commits into from
Apr 23, 2024
Merged

content security policy audit #1331

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
16efc73
[RB] - add content security policy report header to all requests so t…
Apr 11, 2024
b86f94a
[RB] - change status code for content security audit endpoint from 20…
Apr 11, 2024
9336e7d
[RB] - add domain prefix to the CSP report url
Apr 17, 2024
fce7ef4
[RB] - add the csp audit api endpoint to the allowed list of endpoint…
Apr 18, 2024
0359a76
[RB] - put csp audit work behind feature switch
Apr 22, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 9 additions & 0 deletions server/routes/api.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,6 @@
import * as Sentry from '@sentry/node';
import { Router } from 'express';
import { featureSwitches } from '../../shared/featureSwitches';
import type { MembersDataApiResponse } from '../../shared/productResponse';
import { isProduct, MDA_TEST_USER_HEADER } from '../../shared/productResponse';
import {
Expand Down Expand Up @@ -339,4 +340,12 @@ router.get(
router.post('/reminders/cancel', cancelReminderHandler);
router.post('/reminders/reactivate', reactivateReminderHandler);

if (featureSwitches.cspSecurityAudit) {
router.post('/csp-audit-report-endpoint', (req, res) => {
const parsedBody = JSON.parse(req.body.toString());
log.warn(JSON.stringify(parsedBody));

@johnduffell johnduffell Apr 22, 2024

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

looking at the screenshot in the description, it ends up as double nested JSON. Is there a way to inline this JSON? or at least prettyPrint i.e. 2 space indent etc?
No worries if not but it might help!

res.status(204).end();
});
}

export { router };
13 changes: 13 additions & 0 deletions server/server.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,7 @@ import cookieParser from 'cookie-parser';
import type { NextFunction, Request, RequestHandler, Response } from 'express';
import { default as express } from 'express';
import helmet from 'helmet';
import { featureSwitches } from '../shared/featureSwitches';
import { MAX_FILE_ATTACHMENT_SIZE_KB } from '../shared/fileUploadUtils';
import { conf } from './config';
import { log } from './log';
Expand Down Expand Up @@ -39,6 +40,18 @@ if (conf.DOMAIN === 'thegulocal.com') {

server.use(helmet());

if (featureSwitches.cspSecurityAudit) {
server.use(function (_: Request, res: Response, next: NextFunction) {
res.set({
'Report-To':
'{ "group": "csp-endpoint", "endpoints": [ { "url": "/api/csp-audit-report-endpoint" } ] }',
'Content-Security-Policy-Report-Only':
'report-uri /api/csp-audit-report-endpoint; report-to csp-endpoint; default-src https:',
});
next();
});
}

const serveStaticAssets: RequestHandler = express.static(__dirname + '/static');

/** static asses are cached by fastly */
Expand Down
4 changes: 3 additions & 1 deletion shared/featureSwitches.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,11 +27,13 @@ type FeatureSwitchName =
| 'exampleFeature'
| 'appSubscriptions'
| 'supporterPlusUpdateAmount'
| 'digisubSave';
| 'digisubSave'
| 'cspSecurityAudit';

export const featureSwitches: Record<FeatureSwitchName, boolean> = {
exampleFeature: false,
appSubscriptions: true,
supporterPlusUpdateAmount: true,
digisubSave: true,
cspSecurityAudit: true,
};
1 change: 1 addition & 0 deletions shared/requiresSignin.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,7 @@ const publicPaths = [
'/api/reminders/cancel/',
'/api/public/reminders/',
'/api/help-centre/',
'/api/csp-audit-report-endpoint/',
'/cancel-reminders/',
'/create-reminder/',
'/help-centre/',
Expand Down