1050350 - Stop allowing insecure CSP resources in webpay production

Status: RESOLVED FIXED

(Marketplace Graveyard :: Payments/Refunds, defect, P2)

Description

[Kumar McMillan [:kumar]]

Webpay has this line in its base settings which means it will apply to production:

# When running in DEBUG mode, we assume you are running locally
# and are not using SSL. If that's the case, resources might load
# as http too.
if DEBUG:
    for key in ('CSP_IMG_SRC', 'CSP_MEDIA_SRC', 'CSP_SCRIPT_SRC'):
        values = locals()[key]
        new = []
        for value in values:
            if value.startswith('https://'):
                new.append(value.replace('https://', 'http://'))
        locals()[key] = tuple(list(values) + new)

https://github.com/mozilla/webpay/blob/master/webpay/settings/base.py#L326-L336

The reason it applies to prod is that when the base settings file is executed, DEBUG is always True.

There is no reason why we should allow HTTP resources via CSP in production.

Comment 1

[Andy McKay]

https://github.com/mozilla/webpay/pull/551

Comment 2

[Andy McKay]

STR: 

curl -I https://[server you are testing it on]/mozpay/

ensure that there is no http:// in the Content-Security-Policy-Report-Only section.