Improve CSP config #5724
Description
Why are we doing this?
🧵 thread
How will we know when it's done?
Our CSP is even stronger than it is now.
What are we doing?
Following Suzanne's suggestions to make some easy improvements to the CSP settings, without making wider changes to the site.
CSP suggestions from Mozilla's guide:
- Add object-src 'none' to block legacy
<object>and<embed>elements - Add base-uri 'none' to block
<base>elements that would change the hostname of relative links.
She also made this suggestion from OWASP, but it may have issues with the outputs viewer:
- Add frame-ancestors 'none' or frame-ancestors 'self' to prevent clickjacking through embedding the site in an iframe (though probably not necessary because job-server sets the x-frame-options: SAMEORIGIN header)