1444808 - Remove Additional Content Security Policy

Status: RESOLVED FIXED

(Cloud Services :: Operations: LandoUI, task)

Description

[Israel Madueme [:imadueme]]

LandoUI's flask application injects a content security policy header on every request.

It seems that another header is being injected after the flask response is emitted.

My guess is that our nginx configuration is adding this extra header. If this is the case, it should be removed. The flask application will be responsible for adding the CSP header on all requests.

**Flask header**:
Content-Security-Policy: report-uri /__cspreport__; default-src 'self'; object-src 'none'; img-src 'self' *.cloudfront.net *.gravatar.com *.googleusercontent.com; manifest-src 'none'; base-uri 'none'; media-src 'none'; frame-ancestors 'none'; style-src 'self' https://code.cdn.mozilla.net; font-src 'self' https://code.cdn.mozilla.net; frame-src 'none'; worker-src 'none'

**Additional Mystery Header**:
Content-Security-Policy: default-src 'self' data: 'unsafe-inline'; script-src 'self' 'unsafe-inline'; object-src 'self'; report-uri /__cspreport__

This is causing images and fonts to fail to load.

Comment 1

[Israel Madueme [:imadueme]]

This was observed on https://lando.devsvcdev.mozaws.net/

Comment 2

[Chris Kolosiwsky [:ckolos] (ckolos has left the building)]

fixed