Skip to content

Commit

Permalink
Make CSP one liners (#1986)
Browse files Browse the repository at this point in the history
  • Loading branch information
@jadmsaadaot
jadmsaadaot authored Aug 10, 2023
1 parent 8182008 commit 5799a8f
Show file tree
Hide file tree
Showing 3 changed files with 14 additions and 47 deletions.
23 changes: 5 additions & 18 deletions met-web/nginx/nginx.dev.conf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -41,27 +41,14 @@ http {

# add in most common security headers
add_header Content-Security-Policy "
default-src 'self' https://kit.fontawesome.com https://ka-f.fontawesome.com data: blob: filesystem:
'unsafe-inline' 'unsafe-eval';
script-src 'self' 'sha256-JXGej4mPACbE/fP5kuunldJEyMk62sNjNe85DtAcMoU=' https://kit.fontawesome.com
https://ka-f.fontawesome.com https://www2.gov.bc.ca https://cdn.form.io https://api.mapbox.com
https://www.youtube.com https://player.vimeo.com 'unsafe-eval';
default-src 'self' https://kit.fontawesome.com https://ka-f.fontawesome.com data: blob: filesystem: 'unsafe-inline' 'unsafe-eval';
script-src 'self' 'sha256-JXGej4mPACbE/fP5kuunldJEyMk62sNjNe85DtAcMoU=' https://kit.fontawesome.com https://ka-f.fontawesome.com https://www2.gov.bc.ca https://cdn.form.io https://api.mapbox.com https://www.youtube.com https://player.vimeo.com 'unsafe-eval';
worker-src 'self' blob:;
img-src 'self' data: blob: https://citz-gdx.objectstore.gov.bc.ca;
style-src 'self' 'unsafe-inline';
connect-src 'self' https://spt.apps.gov.bc.ca/com.snowplowanalytics.snowplow/tp2
https://epic-engage-analytics-api-dev.apps.gold.devops.gov.bc.ca
https://met-analytics-api-dev.apps.gold.devops.gov.bc.ca
https://epic-engage-oidc-dev.apps.gold.devops.gov.bc.ca
https://met-oidc-dev.apps.gold.devops.gov.bc.ca https://kit.fontawesome.com https://ka-f.fontawesome.com
https://citz-gdx.objectstore.gov.bc.ca https://api.mapbox.com https://governmentofbc.maps.arcgis.com
https://tiles.arcgis.com https://www.arcgis.com;
frame-src 'self' https://met-oidc-dev.apps.gold.devops.gov.bc.ca
https://epic-engage-analytics-api-dev.apps.gold.devops.gov.bc.ca
https://epic-engage-oidc-dev.apps.gold.devops.gov.bc.ca https://met-analytics-dev.apps.gold.devops.gov.bc.ca
https://www.youtube.com https://player.vimeo.com;
frame-ancestors 'self' https://met-oidc-dev.apps.gold.devops.gov.bc.ca
https://epic-engage-oidc-dev.apps.gold.devops.gov.bc.ca";
connect-src 'self' https://spt.apps.gov.bc.ca/com.snowplowanalytics.snowplow/tp2 https://epic-engage-analytics-api-dev.apps.gold.devops.gov.bc.ca https://met-analytics-api-dev.apps.gold.devops.gov.bc.ca https://epic-engage-oidc-dev.apps.gold.devops.gov.bc.ca https://met-oidc-dev.apps.gold.devops.gov.bc.ca https://kit.fontawesome.com https://ka-f.fontawesome.com https://citz-gdx.objectstore.gov.bc.ca https://api.mapbox.com https://governmentofbc.maps.arcgis.com https://tiles.arcgis.com https://www.arcgis.com;
frame-src 'self' https://met-oidc-dev.apps.gold.devops.gov.bc.ca https://epic-engage-analytics-api-dev.apps.gold.devops.gov.bc.ca https://epic-engage-oidc-dev.apps.gold.devops.gov.bc.ca https://met-analytics-dev.apps.gold.devops.gov.bc.ca https://www.youtube.com https://player.vimeo.com;
frame-ancestors 'self' https://met-oidc-dev.apps.gold.devops.gov.bc.ca https://epic-engage-oidc-dev.apps.gold.devops.gov.bc.ca";
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains";
add_header X-Content-Type-Options "nosniff";
add_header X-XSS-Protection 1;
Expand Down
16 changes: 4 additions & 12 deletions met-web/nginx/nginx.prod.conf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -41,21 +41,13 @@ http {

# add in most common security headers
add_header Content-Security-Policy "
default-src 'self' https://kit.fontawesome.com https://ka-f.fontawesome.com data: blob: filesystem:
'unsafe-inline' 'unsafe-eval';
script-src 'self' 'sha256-JXGej4mPACbE/fP5kuunldJEyMk62sNjNe85DtAcMoU=' https://kit.fontawesome.com
https://ka-f.fontawesome.com https://www2.gov.bc.ca https://cdn.form.io https://api.mapbox.com
https://www.youtube.com https://player.vimeo.com 'unsafe-eval';
default-src 'self' https://kit.fontawesome.com https://ka-f.fontawesome.com data: blob: filesystem: 'unsafe-inline' 'unsafe-eval';
script-src 'self' 'sha256-JXGej4mPACbE/fP5kuunldJEyMk62sNjNe85DtAcMoU=' https://kit.fontawesome.com https://ka-f.fontawesome.com https://www2.gov.bc.ca https://cdn.form.io https://api.mapbox.com https://www.youtube.com https://player.vimeo.com 'unsafe-eval';
worker-src 'self' blob:;
img-src 'self' data: blob: https://citz-gdx.objectstore.gov.bc.ca;
style-src 'self' 'unsafe-inline';
connect-src 'self' https://spt.apps.gov.bc.ca/com.snowplowanalytics.snowplow/tp2
https://met-analytics-api.apps.gold.devops.gov.bc.ca
https://met-oidc.apps.gold.devops.gov.bc.ca https://kit.fontawesome.com https://ka-f.fontawesome.com
https://citz-gdx.objectstore.gov.bc.ca https://api.mapbox.com https://governmentofbc.maps.arcgis.com
https://tiles.arcgis.com https://www.arcgis.com;
frame-src 'self' https://met-oidc.apps.gold.devops.gov.bc.ca
https://met-analytics.apps.gold.devops.gov.bc.ca https://www.youtube.com https://player.vimeo.com;
connect-src 'self' https://spt.apps.gov.bc.ca/com.snowplowanalytics.snowplow/tp2 https://met-analytics-api.apps.gold.devops.gov.bc.ca https://met-oidc.apps.gold.devops.gov.bc.ca https://kit.fontawesome.com https://ka-f.fontawesome.com https://citz-gdx.objectstore.gov.bc.ca https://api.mapbox.com https://governmentofbc.maps.arcgis.com https://tiles.arcgis.com https://www.arcgis.com;
frame-src 'self' https://met-oidc.apps.gold.devops.gov.bc.ca https://met-analytics.apps.gold.devops.gov.bc.ca https://www.youtube.com https://player.vimeo.com;
frame-ancestors 'self' https://met-oidc.apps.gold.devops.gov.bc.ca";
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains";
add_header X-Content-Type-Options "nosniff";
Expand Down
22 changes: 5 additions & 17 deletions met-web/nginx/nginx.test.conf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -41,26 +41,14 @@ http {

# add in most common security headers
add_header Content-Security-Policy "
default-src 'self' https://kit.fontawesome.com https://ka-f.fontawesome.com data: blob: filesystem:
'unsafe-inline' 'unsafe-eval';
script-src 'self' 'sha256-JXGej4mPACbE/fP5kuunldJEyMk62sNjNe85DtAcMoU=' https://kit.fontawesome.com
https://ka-f.fontawesome.com https://www2.gov.bc.ca https://cdn.form.io https://api.mapbox.com
https://www.youtube.com https://player.vimeo.com 'unsafe-eval';
default-src 'self' https://kit.fontawesome.com https://ka-f.fontawesome.com data: blob: filesystem: 'unsafe-inline' 'unsafe-eval';
script-src 'self' 'sha256-JXGej4mPACbE/fP5kuunldJEyMk62sNjNe85DtAcMoU=' https://kit.fontawesome.com https://ka-f.fontawesome.com https://www2.gov.bc.ca https://cdn.form.io https://api.mapbox.com https://www.youtube.com https://player.vimeo.com 'unsafe-eval';
worker-src 'self' blob:;
img-src 'self' data: blob: https://citz-gdx.objectstore.gov.bc.ca;
style-src 'self' 'unsafe-inline';
connect-src 'self' https://spt.apps.gov.bc.ca/com.snowplowanalytics.snowplow/tp2
https://epic-engage-analytics-api-test.apps.gold.devops.gov.bc.ca
https://epic-engage-oidc-test.apps.gold.devops.gov.bc.ca
https://met-analytics-api-test.apps.gold.devops.gov.bc.ca
https://met-oidc-test.apps.gold.devops.gov.bc.ca https://kit.fontawesome.com https://ka-f.fontawesome.com
https://citz-gdx.objectstore.gov.bc.ca https://api.mapbox.com https://governmentofbc.maps.arcgis.com
https://tiles.arcgis.com https://www.arcgis.com;
frame-src 'self' https://met-oidc-test.apps.gold.devops.gov.bc.ca
https://epic-engage-oidc-test.apps.gold.devops.gov.bc.ca https://epic-engage-analytics-api-test.apps.gold.devops.gov.bc.ca
https://met-analytics-test.apps.gold.devops.gov.bc.ca https://www.youtube.com https://player.vimeo.com;
frame-ancestors 'self' https://met-oidc-test.apps.gold.devops.gov.bc.ca
https://epic-engage-oidc-test.apps.gold.devops.gov.bc.ca";
connect-src 'self' https://spt.apps.gov.bc.ca/com.snowplowanalytics.snowplow/tp2 https://epic-engage-analytics-api-test.apps.gold.devops.gov.bc.ca https://epic-engage-oidc-test.apps.gold.devops.gov.bc.ca https://met-analytics-api-test.apps.gold.devops.gov.bc.ca https://met-oidc-test.apps.gold.devops.gov.bc.ca https://kit.fontawesome.com https://ka-f.fontawesome.com https://citz-gdx.objectstore.gov.bc.ca https://api.mapbox.com https://governmentofbc.maps.arcgis.com https://tiles.arcgis.com https://www.arcgis.com;
frame-src 'self' https://met-oidc-test.apps.gold.devops.gov.bc.ca https://epic-engage-oidc-test.apps.gold.devops.gov.bc.ca https://epic-engage-analytics-api-test.apps.gold.devops.gov.bc.ca https://met-analytics-test.apps.gold.devops.gov.bc.ca https://www.youtube.com https://player.vimeo.com;
frame-ancestors 'self' https://met-oidc-test.apps.gold.devops.gov.bc.ca https://epic-engage-oidc-test.apps.gold.devops.gov.bc.ca";
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains";
add_header X-Content-Type-Options "nosniff";
add_header X-XSS-Protection 1;
Expand Down

0 comments on commit 5799a8f

Please sign in to comment.