Merge pull request #4244 from EdOverflow/csp

Implement Content-Security-Policy (CSP)
gratipay · Dec 22, 2016 · 3b2872f · 3b2872f
2 parents 233b62f + b7a398e
commit 3b2872f
Show file tree

Hide file tree

Showing 2 changed files with 25 additions and 0 deletions.
diff --git a/gratipay/security/__init__.py b/gratipay/security/__init__.py
@@ -40,3 +40,16 @@ def add_headers_to_response(response):
     # https://www.owasp.org/index.php/List_of_useful_HTTP_headers
     if 'X-XSS-Protection' not in response.headers:
         response.headers['X-XSS-Protection'] = '1; mode=block'
+
+    # CSP - https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP
+    # Allow resources from gratipay.com & all gratipay subdomains.
+    # Allow fonts from cloud.typography.com.
+    if 'content-security-policy' not in response.headers:
+        response.headers['content-security-policy'] = ( 'default-src \'self\';' 
+                                                        'script-src assets.gratipay.com;'
+                                                        'style-src assets.gratipay.com;'
+                                                        'img-src *;'
+                                                        'font-src cloud.typography.com;' 
+                                                        'upgrade-insecure-requests;'
+                                                        'block-all-mixed-content;'
+                                                        'reflected-xss block;')
diff --git a/tests/py/test_security.py b/tests/py/test_security.py
@@ -53,6 +53,18 @@ def test_ahtr_sets_x_xss_protection(self):
         headers = self.client.GET('/about/').headers
         assert headers['X-XSS-Protection'] == '1; mode=block'
 
+    def test_ahtr__csp(self):
+        headers = self.client.GET('/about/').headers
+        policy = ('default-src \'self\';' 
+                    'script-src assets.gratipay.com;'
+                    'style-src assets.gratipay.com;'
+                    'img-src *;'
+                    'font-src cloud.typography.com;' 
+                    'upgrade-insecure-requests;'
+                    'block-all-mixed-content;'
+                    'reflected-xss block;')
+        assert headers['content-security-policy'] == policy
+
 
     # ep - EncryptingPacker