DGNum/demarches-normaliennes
11
1
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity

del(env): delete CSP_REPORT_URI env var and associated config.

Browse source
This commit is contained in:
Bastien Ogier 2024-02-14 11:17:20 +01:00
parent 3237ea8e9f
commit 2231931bb1
3 changed files with 0 additions and 10 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
config/env.example.optional
View file

@ -104,9 +104,6 @@ DS_ENV="staging"
# External service: Matomo web analytics
MATOMO_IFRAME_URL="https://matomo.example.org/index.php?module=CoreAdminHome&action=optOut&language=fr&&fontColor=333333&fontSize=16px&fontFamily=Muli"
# An URI used to report requests breaking the Content Security Policy
# CSP_REPORT_URI="https://myappname.report-uri.com/r/d/csp/reportOnly"
# Landing page sections
# LANDING_TESTIMONIALS_ENABLED="enabled"
# LANDING_USERS_ENABLED="enabled"

1
config/initializers/02_urls.rb
View file

@ -45,5 +45,4 @@ DOC_PROCEDURE_EXPIRES_URL = [DOC_URL, "expiration-et-suppression-des-dossiers"].
STATUS_PAGE_URL = ENV.fetch("STATUS_PAGE_URL", "https://status.demarches-simplifiees.fr")
DEMANDE_INSCRIPTION_ADMIN_PAGE_URL = ENV.fetch("DEMANDE_INSCRIPTION_ADMIN_PAGE_URL", "https://www.demarches-simplifiees.fr/commencer/demande-d-inscription-a-demarches-simplifiees")
MATOMO_IFRAME_URL = ENV.fetch("MATOMO_IFRAME_URL", "https://#{ENV.fetch('MATOMO_HOST', 'stats.data.gouv.fr')}/index.php?module=CoreAdminHome&action=optOut&language=fr&&fontColor=333333&fontSize=16px&fontFamily=Muli")
CSP_REPORT_URI = ENV.fetch("CSP_REPORT_URI", "")
# rubocop:enable DS/ApplicationName

6
config/initializers/content_security_policy.rb
View file

@ -51,10 +51,6 @@ Rails.application.config.content_security_policy do |policy|
policy.connect_src(*policy.connect_src, "ws://#{ViteRuby.config.host_with_port}")
policy.script_src(*policy.script_src, :unsafe_eval, "http://#{ViteRuby.config.host_with_port}")
# CSP are not enforced in development (see content_security_policy_report_only in development.rb)
# However we notify a random local URL, to see breakage in the DevTools when adding a new external resource.
policy.report_uri CSP_REPORT_URI if CSP_REPORT_URI.present?
elsif Rails.env.test?
# Disallow all connections to external domains during tests
policy.img_src(:self, :data, :blob)
@ -64,8 +60,6 @@ Rails.application.config.content_security_policy do |policy|
policy.frame_src(:self)
policy.default_src(:self, :data, :blob)
else
policy.report_uri CSP_REPORT_URI if CSP_REPORT_URI.present?
end
end