Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add Content-Security-Policy and other headers to vercel.json #846

Open
wants to merge 14 commits into
base: main
Choose a base branch
from
Open

Add Content-Security-Policy and other headers to vercel.json #846

wants to merge 14 commits into from

Conversation

fennifith
Copy link
Member

@fennifith fennifith commented Oct 21, 2023 •
edited

This PR adds various headers (based loosely on express helmet defaults) to the Vercel config. We should make sure that none of these affect valid functionality before merging.

  • Tested against FFG content (check that alert() works within iframes)
  • Document headers in vercel.json.md

@vercel
Copy link

vercel bot commented Oct 21, 2023 •
edited

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name Status Preview Comments Updated (UTC)
unicorn-utterances ✅ Ready (Inspect) Visit Preview 💬 Add feedback Feb 28, 2024 4:03am

@fennifith fennifith marked this pull request as ready for review October 21, 2023 03:33
crutchcorn
crutchcorn requested changes Oct 21, 2023
View reviewed changes
Copy link
Member

@crutchcorn crutchcorn left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This PR breaks medium-zoom with the following console error:

image

crutchcorn
crutchcorn requested changes Oct 23, 2023
View reviewed changes
Copy link
Member

@crutchcorn crutchcorn left a comment •
edited

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

image

The FFG site no longer smooth scrolls when the user presses "learn more" in the header as a result of this error

Additionally, the Vercel preview URL comments bar no longer loads as a result of this error:

image

crutchcorn
crutchcorn approved these changes Feb 18, 2024
View reviewed changes
Copy link
Member

@crutchcorn crutchcorn left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM!

evelynhathaway
evelynhathaway requested changes Feb 18, 2024
View reviewed changes
Copy link
Member

@evelynhathaway evelynhathaway left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I cannot sign into Vercel preview comments

image

vercel.json Show resolved Hide resolved
@fennifith
fix #841 - add Content-Security-Policy and other headers to vercel.json
00220b4
@fennifith
enable href-container-script through addEventListener rather than usi…
53dab06 
…ng event script attrs
@fennifith
update CSP to allow convertkit form-action, allow only inline style a…
65f3258 
…ttr sources, etc.
@fennifith
revert style-src to allow unsafe-inline for medium-zoom
af3ca72
@fennifith
fix convertkit form-action being disallowed due to its redirect response
87f7d0e
@fennifith
fix CSP for inline scripts and vercel's weird comments widget
3d284e1
@fennifith
revert href-container-script changes now that unsafe-inline is enabled
1a5acc5
@fennifith
fix build, add Permissions-Policy & Access-Control-Allow-Origin headers
c0c1528
@fennifith
fix vercel comments widget by turning off CSP header on preview builds
a65e118
@fennifith
also remove cross-origin-opener-policy to allow login window
968381b
@fennifith
add more lenient CSP/COOP headers for preview
7ff3aa7
@fennifith
update headers & add documentation
b0c665e
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@evelynhathaway evelynhathaway evelynhathaway requested changes

@crutchcorn crutchcorn crutchcorn approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
3 participants
@fennifith @crutchcorn @evelynhathaway