1051766 - CSP warnings are shown on dev

Status: RESOLVED WONTFIX

(Marketplace Graveyard :: Consumer Pages, defect, P3)

Description

[Mathieu Pillard [:mat]]

STR:
- Load https://marketplace-dev.allizom.org/ with Firefox 30
- Look at your console

I get these CSP warnings, which are a bit scary, even though everything /seems/ to be working fine:

- Content Security Policy: The page's settings blocked the loading of a resource at https://bam.nr-data.net/jserrors/<snip> ("img-src https://marketplace-dev.allizom.org:443 http://localhost:80 https://ssl.google-analytics.com:443 https://www.google-analytics.com:443 https://*.newrelic.com:443 data://*:* http://ssl.google-analytics.com:80 http://www.google-analytics.com:80 http://*.newrelic.com:80 https://marketplace-dev.mozflare.net:443")

- Content Security Policy: The page's settings blocked the loading of a resource at https://marketplace-dev.mozflare.net/api/v1/fireplace/search/featured/?cache=1&cat=&lang=fr&limit=25&region=fr&vary=0 ("default-src https://marketplace-dev.allizom.org:443").

- Content Security Policy: The page's settings blocked the loading of a resource at https://marketplace-dev.allizom.org/iframe-install.html/ ("frame-src https://s3.amazonaws.com:443 
https://ssl.google-analytics.com:443 https://login.persona.org:443 https://firefoxos.persona.org:443 https://www.youtube.com:443").

- Content Security Policy: The page's settings blocked the loading of a resource: An attempt to execute inline scripts has been blocked

In addition, it's also complaining about:
- Content Security Policy: allow directive is deprecated, use the equivalent default-src directive instead
- The X-Content-Security-Policy and X-Content-Security-Report-Only headers will be deprecated in the future. Please use the Content-Security-Policy and Content-Security-Report-Only headers with CSP spec compliant syntax instead.

Comment 1

[Wil Clouser [:clouserw]]

upgrading to the newer https://github.com/mozilla/django-csp will fix the deprecation warnings.  The security team has signed off on us lowering our CSP thresholds in an effort to get *something* live rather than waiting of perfection.  See AMO for details - we'll just be matching that.

Comment 2

[Christopher Van Wiemeersch [:cvan]]

Most of this is from New Relic, btw. I'm curious why we get these errors on https://marketplace-dev.allizom.org/ but not https://marketplace.firefox.com/

Comment 3

[Wil Clouser [:clouserw]]

CSP is off in prod.

Comment 4

[Ram Dayal Vaishnav [:ram]]

Hi Andy/MP-Team, it looks like this might not be very much clear to the newbie how to fix this. Can you put some information here for newbies so that they can pick this bug and fix it.

Thanks,
Ram

Comment 5

[Andy McKay]

CSP is the Content Security Policy: https://developer.mozilla.org/en-US/docs/Web/Security/CSP

CSP is defined in zamboni: https://github.com/mozilla/zamboni/search?p=1&q=CSP&utf8=%E2%9C%93

The CSP rules often need tweaking to be kept up to date. Beyond that, I'm not sure what to add beyond the original descirption.

Comment 6

[Andreas Wagner [:TheOne] [use NI]]

Jared, are you still working on this bug?