csp: embed policy name in reports#1814
Conversation
This should significantly simplify understanding of reports.
| include /usr/share/odk/nginx/common-headers.conf; | ||
| } | ||
|
|
||
| location /csp-report { |
There was a problem hiding this comment.
I think the removal of this line probably means that there's something to change about user docs. At https://docs.getodk.org/central-install-digital-ocean/#disabling-or-customizing-sentry, when describing how to disable Sentry, this line is referenced.
| location = /csp/b/err { include /usr/share/odk/nginx/csp.conf; } | ||
| location = /csp/r/err { include /usr/share/odk/nginx/csp.conf; } | ||
| location = /csp/b/fe { include /usr/share/odk/nginx/csp.conf; } | ||
| location = /csp/r/fe { include /usr/share/odk/nginx/csp.conf; } | ||
| location = /csp/b/wf { include /usr/share/odk/nginx/csp.conf; } | ||
| location = /csp/r/wf { include /usr/share/odk/nginx/csp.conf; } | ||
| location = /csp/b/XX { include /usr/share/odk/nginx/csp.conf; } | ||
| location = /csp/r/XX { include /usr/share/odk/nginx/csp.conf; } |
There was a problem hiding this comment.
Most of these make sense to me, but there are two that I don't fully understand:
err. I think this means: "The default Content Security Policy. It's supposed to be overridden, so if it's seen in Sentry, something unexpected has happened."XX. In tests, I see this is related tobackend-unmodified. I don't totally remember whatbackend-unmodifiedis for though. Would you mind jogging my memory? IsXXjust for testing? Could it be renamed totest?
Just to make sure I understand this, I think it helps because it will surface the policy name in Sentry, because Sentry shows the full Content Security Policy, which includes the |
|
Consider for the future. For now, other approaches have helped identify which policy is active. |
2 participants
This should significantly simplify understanding of reports.
What has been done to verify that this works as intended?
Updated tests.
Why is this the best possible solution? Were any other approaches considered?
It makes every header bigger, so I've aimed to keep the additional data small.
How does this change affect users? Describe intentional changes to behavior and behavior that could have accidentally been affected by code changes. In other words, what are the regression risks?
Should not have a noticeable effect.
Does this change require updates to documentation? If so, please file an issue here and include the link below.
No.
Before submitting this PR, please make sure you have:
nextbranch OR only changed documentation/infrastructure (masteris stable and used in production)