Configure Content-Security-Policy for datagrepper, for the future.

2017-06-01 03:42:42 +00:00 · 2017-06-01 03:42:42 +00:00 · 049effe2e2
commit 049effe2e2
parent cc0a37c9d9
1 changed files with 4 additions and 0 deletions
--- a/roles/datagrepper/templates/datagrepper-fedmsg.py
+++ b/roles/datagrepper/templates/datagrepper-fedmsg.py
@ -17,4 +17,8 @@ config = {
    'fedmenu_url': 'https://apps.fedoraproject.org/fedmenu',
    'fedmenu_data_url': 'https://apps.fedoraproject.org/js/data.js',
    {% endif %}
+
+    # Only allow ajax/websockets connections back to our domains.
+    # https://github.com/fedora-infra/datagrepper/pull/192
+    'content_security_policy': 'connect-src https://*.fedoraproject.org wss://*.fedoraproject.org'
 }