From cb482e70a5b08ac419eeebbde38ebd2bc6619517 Mon Sep 17 00:00:00 2001 From: Robert Sparks Date: Thu, 18 May 2023 13:18:43 -0500 Subject: [PATCH] chore: keep csp config in sync with production configuration --- ietf/settings.py | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/ietf/settings.py b/ietf/settings.py index 00e7f292fe..9868f91a54 100644 --- a/ietf/settings.py +++ b/ietf/settings.py @@ -532,7 +532,9 @@ def skip_unreadable_post(record): IDNITS_SERVICE_URL = "https://author-tools.ietf.org/idnits" # Content security policy configuration (django-csp) -CSP_DEFAULT_SRC = ("'self'", "'unsafe-inline'", f"data: {IDTRACKER_BASE_URL} https://www.ietf.org/ https://analytics.ietf.org/ https://fonts.googleapis.com/") +# (In current production, the Content-Security-Policy header is completely set by nginx configuration, but +# we try to keep this in sync to avoid confusion) +CSP_DEFAULT_SRC = ("'self'", "'unsafe-inline'", f"data: {IDTRACKER_BASE_URL} http://ietf.org/ https://www.ietf.org/ https://analytics.ietf.org/ https://static.ietf.org") # The name of the method to use to invoke the test suite TEST_RUNNER = 'ietf.utils.test_runner.IetfTestRunner'