672001 - Implement Content Security Policy (CSP) for browserid / Persona

Status: RESOLVED WONTFIX

(Cloud Services :: Server: Identity, defect)

Description

[Michael Coates [:mcoates] (acct no longer active)]

Issue

The browserid.org website is not leveraging the additional security benefits provided by Content Security Policy (CSP).  The first step in implementing CSP is to fully externalize all JavaScript. This requires moving any inline javascript to an external javascript file that is referenced via src=. In addition some javascript calls such as "eval" or not allowed.

CSP can then be implemented via a response header with a defined CSP policy. This can be enabled in "report-only" mode initially to debug any potential violations.

It is easier to add CSP to a site early in the development process to minimize the amount of javascript that may need to be externalized.


Recommended Remediation
Externalize current javascript and enable content security policy.

Additional information
https://developer.mozilla.org/en/introducing_content_security_policy

Comment 1

[Yvan Boily [:ygjb][:yvan]]

Adding keywords to bugs for metrics, no action required.  Sorry about bugmail spam.

Comment 2

[Frederik Braun [:freddy]]

How can we move forward with this? There are no blocker's listed. If it's just waiting for a good policy being built, I can find somebody to help you with this.

Comment 3

[Frederik Braun [:freddy]]

Also, any objections to opening this bug? It's pretty easy to see that we're not sending out the header on persona/browserid.org :)

Comment 4

[Frederik Braun [:freddy]]

Adding volunteers working on CSP adoption to this bug

Comment 5

[François Marier [:francois]]

Moving to the right product...

Comment 6

[François Marier [:francois]]

This is also on the main bug tracker for Persona: https://github.com/mozilla/browserid/issues/3271

Comment 7

[Ryan Kelly [:rfkelly]]

I think we should WONTFIX this given our announced plans and timeline for decommissioning persona.