task/WI-472: Review CSP differences between service.conf.template and default.conf.template

[fnets]

Overview

Review CSP differences between service.conf.template and default.conf.template. We have three nginx templates in Camino. Two share the same permissive CSP (default.conf.template and sad.cms.template); one has a comprehensive CSP (service.conf.template).

Is service.conf.template reasonable, or is it overly aggressive (e.g. forcing every service deployment to enumerate CDN allowances)? Does default.conf.template need to change? (Same question applies to sad.cms.template since its CSP is identical.) Is the csp-map file approach working? Are there alternatives? Or better way to make this maintainable?

Related

• WI-472
• task/WI-472: Created view for collecting reports on content-security-policy violations. Core-Portal#1349

Changes

Adding nginx configuration to report violations of content-security-policy to a report url. Adds a Content-Security-Policy in report-only mode ahead of a future enforcing rollout, plus a violation-reporting endpoint. Updates headers to include script-src, style-src, img-src, font-src, connect-src, frame-src, frame-ancestors, base-uri, object-src, and form-action. Uses the existing $cspNonce variable (already defined elsewhere in this config) on script-src/style-src.

Testing

1. Run nginx -t in the nginx container and make sure it passes
2. Run a curl against /csp-report/ and make sure it proxies to portal_core and returns 204 (once the companion Portal PR above is deployed).
3. Confirm via browser devtools that the header is present and CSP warnings appear in console without blocking page functionality.

Notes

We would want to deploy this to staging and then run for a week, then deploy a follow-up PR to turn off Report-Only