CSP configuration for Algolia search (#242)

marcospereira · web-flow · commit 5eed99fcb9bb · 2019-01-10T16:39:37.000-05:00
diff --git a/conf/application.conf b/conf/application.conf
@@ -21,7 +21,7 @@ play {
   filters {
     headers {
       frameOptions = "sameorigin"
-      contentSecurityPolicy="default-src 'self'; img-src 'self' *.githubusercontent.com www.google-analytics.com d379ifj7s9wntv.cloudfront.net; font-src 'self' data: fonts.gstatic.com; script-src 'self' www.google-analytics.com cdn.jsdelivr.net munchkin.marketo.net *.mktoresp.com optanon.blob.core.windows.net 'sha256-Mz1BSEhQ2FXaHzVWxucxc0+PCwT6oyt/5UPqDVlUugs=' 'sha256-1IG7kxxg7+f1m8Iu+Dk44NMBBV2ZjAkq7dalJrzDJMM=' 'sha256-n73RBf/LVzJGkBNoNFYhY2JnwJDTOX/xUOK5XYVcFOI=' 'sha256-DScy2dpFEzZofKeEv/orAZJj/q21B49aHew7suEpfFs=' 'sha256-17TcZWrBMS5XH+2P8hJM6WdgJNdvHZC6w6nhVdCKQoA='; style-src 'self' fonts.googleapis.com cdn.jsdelivr.net 'sha256-HNYzPTRt75YR/Yjz4EVJvRKMVMBbL6CMpl655m4gDcw='; connect-src 'self' *.mktoresp.com"
+      contentSecurityPolicy="default-src 'self'; img-src 'self' *.githubusercontent.com *.google-analytics.com d379ifj7s9wntv.cloudfront.net; font-src 'self' data: fonts.gstatic.com; script-src 'self' 'unsafe-eval' www.google-analytics.com *.googleapis.com cdn.jsdelivr.net munchkin.marketo.net *.mktoresp.com optanon.blob.core.windows.net 'sha256-Mz1BSEhQ2FXaHzVWxucxc0+PCwT6oyt/5UPqDVlUugs=' 'sha256-1IG7kxxg7+f1m8Iu+Dk44NMBBV2ZjAkq7dalJrzDJMM=' 'sha256-n73RBf/LVzJGkBNoNFYhY2JnwJDTOX/xUOK5XYVcFOI=' 'sha256-DScy2dpFEzZofKeEv/orAZJj/q21B49aHew7suEpfFs=' 'sha256-17TcZWrBMS5XH+2P8hJM6WdgJNdvHZC6w6nhVdCKQoA='; style-src 'self' fonts.googleapis.com cdn.jsdelivr.net optanon.blob.core.windows.net 'sha256-HNYzPTRt75YR/Yjz4EVJvRKMVMBbL6CMpl655m4gDcw='; connect-src 'self' *.mktoresp.com"
     }
     hosts {
       allowed = [".playframework.com", "localhost", "playframework-com-app"] # playframework-com-app is the upstream host configured in nginx

Original file line number	Diff line number	Diff line change
`@@ -21,7 +21,7 @@ play {`
`21`	`21`	`filters {`
`22`	`22`	`headers {`
`23`	`23`	`frameOptions = "sameorigin"`
`24`		- contentSecurityPolicy="default-src 'self'; img-src 'self' .githubusercontent.com www.google-analytics.com d379ifj7s9wntv.cloudfront.net; font-src 'self' data: fonts.gstatic.com; script-src 'self' www.google-analytics.com cdn.jsdelivr.net munchkin.marketo.net .mktoresp.com optanon.blob.core.windows.net 'sha256-Mz1BSEhQ2FXaHzVWxucxc0+PCwT6oyt/5UPqDVlUugs=' 'sha256-1IG7kxxg7+f1m8Iu+Dk44NMBBV2ZjAkq7dalJrzDJMM=' 'sha256-n73RBf/LVzJGkBNoNFYhY2JnwJDTOX/xUOK5XYVcFOI=' 'sha256-DScy2dpFEzZofKeEv/orAZJj/q21B49aHew7suEpfFs=' 'sha256-17TcZWrBMS5XH+2P8hJM6WdgJNdvHZC6w6nhVdCKQoA='; style-src 'self' fonts.googleapis.com cdn.jsdelivr.net 'sha256-HNYzPTRt75YR/Yjz4EVJvRKMVMBbL6CMpl655m4gDcw='; connect-src 'self' *.mktoresp.com"
	`24`	+ contentSecurityPolicy="default-src 'self'; img-src 'self' .githubusercontent.com .google-analytics.com d379ifj7s9wntv.cloudfront.net; font-src 'self' data: fonts.gstatic.com; script-src 'self' 'unsafe-eval' www.google-analytics.com .googleapis.com cdn.jsdelivr.net munchkin.marketo.net .mktoresp.com optanon.blob.core.windows.net 'sha256-Mz1BSEhQ2FXaHzVWxucxc0+PCwT6oyt/5UPqDVlUugs=' 'sha256-1IG7kxxg7+f1m8Iu+Dk44NMBBV2ZjAkq7dalJrzDJMM=' 'sha256-n73RBf/LVzJGkBNoNFYhY2JnwJDTOX/xUOK5XYVcFOI=' 'sha256-DScy2dpFEzZofKeEv/orAZJj/q21B49aHew7suEpfFs=' 'sha256-17TcZWrBMS5XH+2P8hJM6WdgJNdvHZC6w6nhVdCKQoA='; style-src 'self' fonts.googleapis.com cdn.jsdelivr.net optanon.blob.core.windows.net 'sha256-HNYzPTRt75YR/Yjz4EVJvRKMVMBbL6CMpl655m4gDcw='; connect-src 'self' *.mktoresp.com"
`25`	`25`	`}`
`26`	`26`	`hosts {`
`27`	`27`	`allowed = [".playframework.com", "localhost", "playframework-com-app"] # playframework-com-app is the upstream host configured in nginx`