Skip to content

content security policy audit #1331

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
rBangay merged 5 commits into from
Apr 23, 2024
Merged

content security policy audit #1331

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
16efc73
[RB] - add content security policy report header to all requests so t…
Apr 11, 2024
b86f94a
[RB] - change status code for content security audit endpoint from 20…
Apr 11, 2024
9336e7d
[RB] - add domain prefix to the CSP report url
Apr 17, 2024
fce7ef4
[RB] - add the csp audit api endpoint to the allowed list of endpoint…
Apr 18, 2024
0359a76
[RB] - put csp audit work behind feature switch
Apr 22, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions server/routes/core.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,11 @@ import { log } from '../log';

const router = Router();

router.get('/csp-audit-report-endpoint', (req: Request, res: Response) => {
log.info(`CSP_AUDIT: ${req.body}`);

@johnduffell johnduffell Apr 11, 2024

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

sometimes cloudwatch is a bit irritating and splits multi line log statements across more than one log line. It does have smarts to spot json, but if we hit this problem, we can always indent subsequent lines (which should help)

res.status(204).send();
});

router.get(
'/_healthcheck',
/**
Expand Down
10 changes: 10 additions & 0 deletions server/server.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,6 +39,16 @@ if (conf.DOMAIN === 'thegulocal.com') {

server.use(helmet());

server.use(function (_: Request, res: Response, next: NextFunction) {
res.set({
'Report-To':
'{ "group": "csp-endpoint", "endpoints": [ { "url": "/csp-audit-report-endpoint" } ] }',
'Content-Security-Policy-Report-Only':
'report-uri /csp-audit-report-endpoint; report-to csp-endpoint; default-src https:',
});
next();
});

const serveStaticAssets: RequestHandler = express.static(__dirname + '/static');

/** static asses are cached by fastly */
Expand Down