UNCLASSIFIED - NO CUI

Skip to content

Bull 472 - Add CSP to nginx

graham.smith requested to merge BULL-472 into master
  • Removed overflow-color dependency since it does not conform to CSP due to inline-styles (could potentially set nonce, but easier to just remove it)
  • refactored nginx configs
  • added CSP to nginx configs
  • added if check in main.js since when the app is served via nginx, api calls that normally would return a 404 if not present will instead return a 200 (with the contents of index.html) due to try_files directive

For testing to see if iframes are disabled, try to run the Launchboard FE in an iframe:

  1. Build FE image 
    docker build -t lb-fe .
  2. Run FE container 
    docker run -it --rm -p 8888:8080 lb-fe
  3. Create a test html file and open it in a browser 
    <html>
  <body>
    iframe test
    <iframe src="http://localhost:8888" title="test"/>
  </body>
</html>
  4. You should see errors in the iframe. (chrome shows frowny document and "localhost refused to connect.")
Edited by graham.smith

Merge request reports

UNCLASSIFIED - NO CUI