From 35dcad146b1aad4c11f88fe410b312ee231fa11e Mon Sep 17 00:00:00 2001
From: Frank Netscher <fnetscher@tacc.utexas.edu>
Date: Mon, 10 Aug 2026 15:47:26 -0500
Subject: [PATCH 1/2] Adding nginx configuration to report violations of
 content-security-policy to a report url

---
 conf/nginx/snippets/cep-headers.conf       | 4 +++-
 conf/nginx/templates/sad.cms.conf.template | 3 ++-
 conf/nginx/templates/service.conf.template | 4 +++-
 3 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/conf/nginx/snippets/cep-headers.conf b/conf/nginx/snippets/cep-headers.conf
index 75944dc..07a98dd 100644
--- a/conf/nginx/snippets/cep-headers.conf
+++ b/conf/nginx/snippets/cep-headers.conf
@@ -16,7 +16,9 @@ add_header X-Content-Type-Options "nosniff" always;
 # are appended via $csp_connect_extra, defined in csp-map.http.conf (overridable per
 # deployment in Core-Portal-Deployments).
 #
-add_header Content-Security-Policy "form-action 'self'; connect-src 'self' ws: wss: https://cdn.jsdelivr.net https://pypi.org https://*.google-analytics.com https://*.analytics.google.com https://*.googletagmanager.com https://*.tacc.utexas.edu https://*.tapis.io https://*.github.com ${csp_connect_extra} 'nonce-$cspNonce'" always;
+add_header Content-Security-Policy-Report-Only "default-src 'self'; form-action 'self'; script-src 'self' https://cdn.jsdelivr.net ${csp_script_extra} 'nonce-$cspNonce'; style-src 'self' 'unsafe-inline' ${csp_style_extra} 'nonce-$cspNonce'; font-src 'self' ${csp_font_extra}; img-src 'self' https://cdn.jsdelivr.net blob: ${csp_img_extra}; frame-src 'self' ${csp_frame_extra}; frame-ancestors 'self' https://*.tacc.utexas.edu; connect-src 'self' ws: wss: https://cdn.jsdelivr.net https://pypi.org https://*.google-analytics.com https://*.analytics.google.com https://*.googletagmanager.com https://*.tacc.utexas.edu https://*.tapis.io https://*.github.com ${csp_connect_extra}; report-uri /csp-report;" always;
+
+add_header Report-To '{"group":"csp-endpoint","max_age":10886400,"endpoints":[{"url":"https://portal.tacc.utexas.edu/csp-report"}]}' always;
 
 add_header X-XSS-Protection "1; mode=block" always;
 add_header Cache-control "no-store";
diff --git a/conf/nginx/templates/sad.cms.conf.template b/conf/nginx/templates/sad.cms.conf.template
index 7950aab..1613fcf 100644
--- a/conf/nginx/templates/sad.cms.conf.template
+++ b/conf/nginx/templates/sad.cms.conf.template
@@ -49,7 +49,8 @@ server {
     #
     # CSP 'frame-ancestors':
     #   Allows services to be iframed into TACC portals (e.g. Imageinf iframed into CEP).
-    add_header Content-Security-Policy "connect-src 'self' ws: wss: https://cdn.jsdelivr.net https://pypi.org https://*.google-analytics.com https://*.analytics.google.com https://*.googletagmanager.com https://*.tacc.utexas.edu ${csp_connect_extra}; frame-ancestors 'self' https://*.tacc.utexas.edu; form-action 'self';" always;
+    add_header Content-Security-Policy-Report-Only "default-src 'self'; form-action 'self'; script-src 'self' https://cdn.jsdelivr.net ${csp_script_extra} 'nonce-$cspNonce'; style-src 'self' 'unsafe-inline' ${csp_style_extra} 'nonce-$cspNonce'; font-src 'self' ${csp_font_extra}; img-src 'self' https://cdn.jsdelivr.net blob: ${csp_img_extra}; frame-src 'self' ${csp_frame_extra}; frame-ancestors 'self' https://*.tacc.utexas.edu; connect-src 'self' ws: wss: https://cdn.jsdelivr.net https://pypi.org https://*.google-analytics.com https://*.analytics.google.com https://*.googletagmanager.com https://*.tacc.utexas.edu https://*.tapis.io https://*.github.com ${csp_connect_extra}; report-uri /csp-report;" always;
+    add_header Report-To '{"group":"csp-endpoint","max_age":10886400,"endpoints":[{"url":"https://portal.tacc.utexas.edu/csp-report"}]}' always;
 
     add_header X-XSS-Protection "1; mode=block" always;
 
diff --git a/conf/nginx/templates/service.conf.template b/conf/nginx/templates/service.conf.template
index b243dbd..79ad160 100644
--- a/conf/nginx/templates/service.conf.template
+++ b/conf/nginx/templates/service.conf.template
@@ -42,7 +42,9 @@ server {
     #
     # CSP 'frame-ancestors':
     #   Allows services to be iframed into TACC portals (e.g. Imageinf iframed into CEP).
-    add_header Content-Security-Policy "default-src 'self'; script-src 'self' ${csp_script_extra}; style-src 'self' 'unsafe-inline' ${csp_style_extra}; font-src 'self' ${csp_font_extra}; img-src 'self' blob: ${csp_img_extra}; connect-src 'self' ws: wss: https://*.google-analytics.com https://*.analytics.google.com https://*.googletagmanager.com https://*.tacc.utexas.edu https://*.tapis.io ${csp_connect_extra}; frame-src 'self' ${csp_frame_extra}; frame-ancestors 'self' https://*.tacc.utexas.edu; form-action 'self';" always;
+    add_header Content-Security-Policy-Report-Only "default-src 'self'; form-action 'self'; script-src 'self' https://cdn.jsdelivr.net ${csp_script_extra} 'nonce-$cspNonce'; style-src 'self' 'unsafe-inline' ${csp_style_extra} 'nonce-$cspNonce'; font-src 'self' ${csp_font_extra}; img-src 'self' https://cdn.jsdelivr.net blob: ${csp_img_extra}; frame-src 'self' ${csp_frame_extra}; frame-ancestors 'self' https://*.tacc.utexas.edu; connect-src 'self' ws: wss: https://cdn.jsdelivr.net https://pypi.org https://*.google-analytics.com https://*.analytics.google.com https://*.googletagmanager.com https://*.tacc.utexas.edu https://*.tapis.io https://*.github.com ${csp_connect_extra}; report-uri /csp-report;" always;
+    add_header Report-To '{"group":"csp-endpoint","max_age":10886400,"endpoints":[{"url":"https://portal.tacc.utexas.edu/csp-report"}]}' always;
+
     add_header X-XSS-Protection "1; mode=block" always;
 
     ## Include any custom location directives

From d7f5cbd14db6109073b84079a7294fff7f294318 Mon Sep 17 00:00:00 2001
From: Frank Netscher <fnetscher@tacc.utexas.edu>
Date: Wed, 26 Aug 2026 11:42:45 -0500
Subject: [PATCH 2/2] Added trailing slash to report uri and fixed uri to use
 the server_name instead of a placeholder I made up.

---
 conf/nginx/snippets/cep-headers.conf       | 5 ++---
 conf/nginx/templates/sad.cms.conf.template | 4 ++--
 conf/nginx/templates/service.conf.template | 4 ++--
 3 files changed, 6 insertions(+), 7 deletions(-)

diff --git a/conf/nginx/snippets/cep-headers.conf b/conf/nginx/snippets/cep-headers.conf
index 07a98dd..b63745b 100644
--- a/conf/nginx/snippets/cep-headers.conf
+++ b/conf/nginx/snippets/cep-headers.conf
@@ -16,9 +16,8 @@ add_header X-Content-Type-Options "nosniff" always;
 # are appended via $csp_connect_extra, defined in csp-map.http.conf (overridable per
 # deployment in Core-Portal-Deployments).
 #
-add_header Content-Security-Policy-Report-Only "default-src 'self'; form-action 'self'; script-src 'self' https://cdn.jsdelivr.net ${csp_script_extra} 'nonce-$cspNonce'; style-src 'self' 'unsafe-inline' ${csp_style_extra} 'nonce-$cspNonce'; font-src 'self' ${csp_font_extra}; img-src 'self' https://cdn.jsdelivr.net blob: ${csp_img_extra}; frame-src 'self' ${csp_frame_extra}; frame-ancestors 'self' https://*.tacc.utexas.edu; connect-src 'self' ws: wss: https://cdn.jsdelivr.net https://pypi.org https://*.google-analytics.com https://*.analytics.google.com https://*.googletagmanager.com https://*.tacc.utexas.edu https://*.tapis.io https://*.github.com ${csp_connect_extra}; report-uri /csp-report;" always;
-
-add_header Report-To '{"group":"csp-endpoint","max_age":10886400,"endpoints":[{"url":"https://portal.tacc.utexas.edu/csp-report"}]}' always;
+add_header Content-Security-Policy-Report-Only "default-src 'self'; form-action 'self'; script-src 'self' https://cdn.jsdelivr.net ${csp_script_extra} 'nonce-$cspNonce'; style-src 'self' 'unsafe-inline' ${csp_style_extra} 'nonce-$cspNonce'; font-src 'self' ${csp_font_extra}; img-src 'self' https://cdn.jsdelivr.net blob: ${csp_img_extra}; frame-src 'self' ${csp_frame_extra}; frame-ancestors 'self' https://*.tacc.utexas.edu; connect-src 'self' ws: wss: https://cdn.jsdelivr.net https://pypi.org https://*.google-analytics.com https://*.analytics.google.com https://*.googletagmanager.com https://*.tacc.utexas.edu https://*.tapis.io https://*.github.com ${csp_connect_extra}; report-uri /csp-report/;" always;
+add_header Report-To '{"group":"csp-endpoint","max_age":10886400,"endpoints":[{"url":"https://${server_name}.tacc.utexas.edu/csp-report"}]}' always;
 
 add_header X-XSS-Protection "1; mode=block" always;
 add_header Cache-control "no-store";
diff --git a/conf/nginx/templates/sad.cms.conf.template b/conf/nginx/templates/sad.cms.conf.template
index 1613fcf..f43d625 100644
--- a/conf/nginx/templates/sad.cms.conf.template
+++ b/conf/nginx/templates/sad.cms.conf.template
@@ -49,8 +49,8 @@ server {
     #
     # CSP 'frame-ancestors':
     #   Allows services to be iframed into TACC portals (e.g. Imageinf iframed into CEP).
-    add_header Content-Security-Policy-Report-Only "default-src 'self'; form-action 'self'; script-src 'self' https://cdn.jsdelivr.net ${csp_script_extra} 'nonce-$cspNonce'; style-src 'self' 'unsafe-inline' ${csp_style_extra} 'nonce-$cspNonce'; font-src 'self' ${csp_font_extra}; img-src 'self' https://cdn.jsdelivr.net blob: ${csp_img_extra}; frame-src 'self' ${csp_frame_extra}; frame-ancestors 'self' https://*.tacc.utexas.edu; connect-src 'self' ws: wss: https://cdn.jsdelivr.net https://pypi.org https://*.google-analytics.com https://*.analytics.google.com https://*.googletagmanager.com https://*.tacc.utexas.edu https://*.tapis.io https://*.github.com ${csp_connect_extra}; report-uri /csp-report;" always;
-    add_header Report-To '{"group":"csp-endpoint","max_age":10886400,"endpoints":[{"url":"https://portal.tacc.utexas.edu/csp-report"}]}' always;
+    add_header Content-Security-Policy-Report-Only "default-src 'self'; form-action 'self'; script-src 'self' https://cdn.jsdelivr.net ${csp_script_extra} 'nonce-$cspNonce'; style-src 'self' 'unsafe-inline' ${csp_style_extra} 'nonce-$cspNonce'; font-src 'self' ${csp_font_extra}; img-src 'self' https://cdn.jsdelivr.net blob: ${csp_img_extra}; frame-src 'self' ${csp_frame_extra}; frame-ancestors 'self' https://*.tacc.utexas.edu; connect-src 'self' ws: wss: https://cdn.jsdelivr.net https://pypi.org https://*.google-analytics.com https://*.analytics.google.com https://*.googletagmanager.com https://*.tacc.utexas.edu https://*.tapis.io https://*.github.com ${csp_connect_extra}; report-uri /csp-report/;" always;
+    add_header Report-To '{"group":"csp-endpoint","max_age":10886400,"endpoints":[{"url":"https://${server_name}.tacc.utexas.edu/csp-report"}]}' always;
 
     add_header X-XSS-Protection "1; mode=block" always;
 
diff --git a/conf/nginx/templates/service.conf.template b/conf/nginx/templates/service.conf.template
index 79ad160..a8e01d9 100644
--- a/conf/nginx/templates/service.conf.template
+++ b/conf/nginx/templates/service.conf.template
@@ -42,8 +42,8 @@ server {
     #
     # CSP 'frame-ancestors':
     #   Allows services to be iframed into TACC portals (e.g. Imageinf iframed into CEP).
-    add_header Content-Security-Policy-Report-Only "default-src 'self'; form-action 'self'; script-src 'self' https://cdn.jsdelivr.net ${csp_script_extra} 'nonce-$cspNonce'; style-src 'self' 'unsafe-inline' ${csp_style_extra} 'nonce-$cspNonce'; font-src 'self' ${csp_font_extra}; img-src 'self' https://cdn.jsdelivr.net blob: ${csp_img_extra}; frame-src 'self' ${csp_frame_extra}; frame-ancestors 'self' https://*.tacc.utexas.edu; connect-src 'self' ws: wss: https://cdn.jsdelivr.net https://pypi.org https://*.google-analytics.com https://*.analytics.google.com https://*.googletagmanager.com https://*.tacc.utexas.edu https://*.tapis.io https://*.github.com ${csp_connect_extra}; report-uri /csp-report;" always;
-    add_header Report-To '{"group":"csp-endpoint","max_age":10886400,"endpoints":[{"url":"https://portal.tacc.utexas.edu/csp-report"}]}' always;
+    add_header Content-Security-Policy-Report-Only "default-src 'self'; form-action 'self'; script-src 'self' https://cdn.jsdelivr.net ${csp_script_extra} 'nonce-$cspNonce'; style-src 'self' 'unsafe-inline' ${csp_style_extra} 'nonce-$cspNonce'; font-src 'self' ${csp_font_extra}; img-src 'self' https://cdn.jsdelivr.net blob: ${csp_img_extra}; frame-src 'self' ${csp_frame_extra}; frame-ancestors 'self' https://*.tacc.utexas.edu; connect-src 'self' ws: wss: https://cdn.jsdelivr.net https://pypi.org https://*.google-analytics.com https://*.analytics.google.com https://*.googletagmanager.com https://*.tacc.utexas.edu https://*.tapis.io https://*.github.com ${csp_connect_extra}; report-uri /csp-report/;" always;
+    add_header Report-To '{"group":"csp-endpoint","max_age":10886400,"endpoints":[{"url":"https://${server_name}.tacc.utexas.edu/csp-report"}]}' always;
 
     add_header X-XSS-Protection "1; mode=block" always;