{"action":"opened","issue":{"url":"https://api.github.com/repos/18F/foia-hub/issues/588","labels_url":"https://api.github.com/repos/18F/foia-hub/issues/588/labels{/name}","comments_url":"https://api.github.com/repos/18F/foia-hub/issues/588/comments","events_url":"https://api.github.com/repos/18F/foia-hub/issues/588/events","html_url":"https://github.com/18F/foia-hub/issues/588","id":59716070,"number":588,"title":"Consider a Content Security Policy","user":{"login":"konklone","id":4592,"avatar_url":"https://avatars.githubusercontent.com/u/4592?v=3","gravatar_id":"","url":"https://api.github.com/users/konklone","html_url":"https://github.com/konklone","followers_url":"https://api.github.com/users/konklone/followers","following_url":"https://api.github.com/users/konklone/following{/other_user}","gists_url":"https://api.github.com/users/konklone/gists{/gist_id}","starred_url":"https://api.github.com/users/konklone/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/konklone/subscriptions","organizations_url":"https://api.github.com/users/konklone/orgs","repos_url":"https://api.github.com/users/konklone/repos","events_url":"https://api.github.com/users/konklone/events{/privacy}","received_events_url":"https://api.github.com/users/konklone/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/18F/foia-hub/labels/dev","name":"dev","color":"fad8c7"},{"url":"https://api.github.com/repos/18F/foia-hub/labels/frontend","name":"frontend","color":"5319e7"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-03-03T22:23:25Z","updated_at":"2015-03-03T22:23:25Z","closed_at":null,"body":"(Originally mistakenly filed in https://github.com/18F/DevOps/issues/263. Not necessary for ATO/sprint.)\r\n\r\nSomething I don't have personal experience with, but which we should look at:\r\n\r\nhttps://developer.mozilla.org/en-US/docs/Web/Security/CSP\r\n\r\nIt's a way for a site to tell a browser that various security properties should be enforced, like not allowing inline JavaScript, only allow includes from certain domains, etc. It can also detect mixed content, though that's a problem we're unlikely to run into.\r\n\r\nViolations of CSP policy will be a) rendered moot (e.g. by not executing non-complaint JS) and can be b) sent to a reporting URI for debugging. You can also turn on a reporting URI but not turn on enforcement, if you just want to get a sense for how widespread a particular problem is. For popular sites, they can generate a good deal of noise, due to browser extensions that change pages in unpredictable ways.\r\n\r\nCSP is most useful for large sites with user-generated content or high level of user activity. We may not end up doing much of anything here - but we should at least consider whether there are any easy things to add."}}