Closed Bug 1009696 Opened 10 years ago Closed 9 years ago

why do we whitelist paypal sandbox on -dev?

Categories

(addons.mozilla.org Graveyard :: Code Quality, defect)

Product:
addons.mozilla.org Graveyard
Component:
Code Quality
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

(Not tracked)

Status:
RESOLVED WONTFIX

People

(Reporter: clouserw, Unassigned)

References

Details

In our CSP rules we whitelist sandbox.paypal.com for frame-src[1].  This is fine if we need it, but dveditz noticed we aren't whitelisting paypal in our production service.  When we turn on production CSP are we going to wish we were?

tl;dr:  Does paypal on AMO use frames and we need to whitelist it in CSP?


[1] https://github.com/mozilla/olympia/blob/master/sites/dev/settings_addons.py#L18
Yes, we should whitelist it in the CSP on prod, paypal opens an iframe to start the payment flow.
Blocks: 594584
We'll address this in https://github.com/mozilla/olympia/issues/995.
Status: NEW → RESOLVED
Closed: 9 years ago
Resolution: --- → WONTFIX
Product: addons.mozilla.org → addons.mozilla.org Graveyard
You need to log in before you can comment on or make changes to this bug.