{"action":"created","issue":{"url":"https://api.github.com/repos/mozilla/fxa-content-server/issues/3179","labels_url":"https://api.github.com/repos/mozilla/fxa-content-server/issues/3179/labels{/name}","comments_url":"https://api.github.com/repos/mozilla/fxa-content-server/issues/3179/comments","events_url":"https://api.github.com/repos/mozilla/fxa-content-server/issues/3179/events","html_url":"https://github.com/mozilla/fxa-content-server/pull/3179","id":111710492,"number":3179,"title":"feat(csp): enable report only CSP in prodiction","user":{"login":"vladikoff","id":128755,"avatar_url":"https://avatars.githubusercontent.com/u/128755?v=3","gravatar_id":"","url":"https://api.github.com/users/vladikoff","html_url":"https://github.com/vladikoff","followers_url":"https://api.github.com/users/vladikoff/followers","following_url":"https://api.github.com/users/vladikoff/following{/other_user}","gists_url":"https://api.github.com/users/vladikoff/gists{/gist_id}","starred_url":"https://api.github.com/users/vladikoff/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/vladikoff/subscriptions","organizations_url":"https://api.github.com/users/vladikoff/orgs","repos_url":"https://api.github.com/users/vladikoff/repos","events_url":"https://api.github.com/users/vladikoff/events{/privacy}","received_events_url":"https://api.github.com/users/vladikoff/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/mozilla/fxa-content-server/labels/waffle:progress","name":"waffle:progress","color":"ededed"}],"state":"open","locked":false,"assignee":{"login":"shane-tomlinson","id":848085,"avatar_url":"https://avatars.githubusercontent.com/u/848085?v=3","gravatar_id":"","url":"https://api.github.com/users/shane-tomlinson","html_url":"https://github.com/shane-tomlinson","followers_url":"https://api.github.com/users/shane-tomlinson/followers","following_url":"https://api.github.com/users/shane-tomlinson/following{/other_user}","gists_url":"https://api.github.com/users/shane-tomlinson/gists{/gist_id}","starred_url":"https://api.github.com/users/shane-tomlinson/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/shane-tomlinson/subscriptions","organizations_url":"https://api.github.com/users/shane-tomlinson/orgs","repos_url":"https://api.github.com/users/shane-tomlinson/repos","events_url":"https://api.github.com/users/shane-tomlinson/events{/privacy}","received_events_url":"https://api.github.com/users/shane-tomlinson/received_events","type":"User","site_admin":false},"milestone":null,"comments":16,"created_at":"2015-10-15T21:23:31Z","updated_at":"2015-11-13T11:49:40Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/mozilla/fxa-content-server/pulls/3179","html_url":"https://github.com/mozilla/fxa-content-server/pull/3179","diff_url":"https://github.com/mozilla/fxa-content-server/pull/3179.diff","patch_url":"https://github.com/mozilla/fxa-content-server/pull/3179.patch"},"body":"Fixes #1426"},"comment":{"url":"https://api.github.com/repos/mozilla/fxa-content-server/issues/comments/156408458","html_url":"https://github.com/mozilla/fxa-content-server/pull/3179#issuecomment-156408458","issue_url":"https://api.github.com/repos/mozilla/fxa-content-server/issues/3179","id":156408458,"user":{"login":"shane-tomlinson","id":848085,"avatar_url":"https://avatars.githubusercontent.com/u/848085?v=3","gravatar_id":"","url":"https://api.github.com/users/shane-tomlinson","html_url":"https://github.com/shane-tomlinson","followers_url":"https://api.github.com/users/shane-tomlinson/followers","following_url":"https://api.github.com/users/shane-tomlinson/following{/other_user}","gists_url":"https://api.github.com/users/shane-tomlinson/gists{/gist_id}","starred_url":"https://api.github.com/users/shane-tomlinson/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/shane-tomlinson/subscriptions","organizations_url":"https://api.github.com/users/shane-tomlinson/orgs","repos_url":"https://api.github.com/users/shane-tomlinson/repos","events_url":"https://api.github.com/users/shane-tomlinson/events{/privacy}","received_events_url":"https://api.github.com/users/shane-tomlinson/received_events","type":"User","site_admin":false},"created_at":"2015-11-13T11:49:40Z","updated_at":"2015-11-13T11:49:40Z","body":"More info - A hash-source problem was fixed in Fx 43 - https://bugzilla.mozilla.org/show_bug.cgi?id=1026520\r\n\r\nI can avoid the CSP error in Firefox with the following `styleSrc` directive:\r\n\r\n```\r\n  styleSrc: [\r\n      SELF,\r\n      \"'sha256-9n6ek6ecEYlqel7uDyKLy6fdGNo3vw/uScXSq9ooQlk='\"\r\n  ]\r\n```\r\nI had an extra `=` on the end that Chrome didn't care about.\r\n\r\nOddly, if I load the svg directly in Safari, it refuses to show because of the CSP violation. If I load `/settings` with full CSP enabled, Safari shows the image anyways. Works fine on Mobile safari too."}}