Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

tech: Remove inline CSS usage #600

Merged
merged 3 commits into from
Jan 16, 2024
Merged

tech: Remove inline CSS usage #600

merged 3 commits into from
Jan 16, 2024

Conversation

pnu-s
Copy link
Member

@pnu-s pnu-s commented Jan 15, 2024

A couple of changes in order to remove inline CSS usage and improve CSP headers.

I made the changes in separate commit in order to make it more readable, but here is what I did in more details:

  • Add django-csp in local dev only in order to have CSP headers locally for testing purposes
  • Remove all inline CSS
  • Prevent ajax call if the handle is empty (currently there is a bug if you start a search without handle on the homepage)
  • Remove "Refresh" debug log line
  • Fix a couple of indentation issues

After releasing this, we'll be able to make the following changes to the CSP headers in production:

  • change default-src from 'self' to 'none'
  • add connect-src with 'self'
  • change style-src from 'self' 'unsafe-inline' 'unsafe-eval' to 'self'

About the CSP, we still need to get rid of unsafe-eval for JS, I'll make a separate PR with this.
There are more indentation issues but I didn't want to clutter the PR even more. I'll make a separate PR.

Copy link
Contributor

@U039b U039b left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you very much! It looks good to me :)

@pnu-s pnu-s merged commit 84b9a22 into v1 Jan 16, 2024
7 checks passed
@pnu-s pnu-s deleted the better_csp branch January 16, 2024 09:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants