1388808 - Set CSP headers in Nginx

Status: RESOLVED FIXED

(Socorro :: Symbols, task)

Description

[Peter Bengtsson [:peterbe]]

Some requests (in particular the frontend) are static assets going straight from Nginx disk back to the client. E.g. / serves the /index.html file.
That means we never go into Django where django_csp sets CSP headers.

Let's move all CSP setting to Nginx.

Comment 1

[Peter Bengtsson [:peterbe]]

I'll make a PR on https://github.com/mozilla-services/cloudops-deployment/blob/symbols/projects/symbols/puppet/modules/symbols/templates/http_symbols.conf.erb 
and I'll remove django_csp and its settings.

Comment 2

[Peter Bengtsson [:peterbe]]

PR https://github.com/mozilla-services/cloudops-deployment/pull/1001

Comment 3

[Peter Bengtsson [:peterbe]]

https://github.com/mozilla-services/cloudops-deployment/commit/489d23f4fa1ba7234e03d53c11c9276e9e494260

Comment 4

[Peter Bengtsson [:peterbe]]

Attachment: Screen Shot 2017-08-10 at 4.21.38 PM.png

Yay!