{"action":"closed","issue":{"url":"https://api.github.com/repos/AppFolioOnboarding/vanilla/issues/41","repository_url":"https://api.github.com/repos/AppFolioOnboarding/vanilla","labels_url":"https://api.github.com/repos/AppFolioOnboarding/vanilla/issues/41/labels{/name}","comments_url":"https://api.github.com/repos/AppFolioOnboarding/vanilla/issues/41/comments","events_url":"https://api.github.com/repos/AppFolioOnboarding/vanilla/issues/41/events","html_url":"https://github.com/AppFolioOnboarding/vanilla/issues/41","id":132564313,"number":41,"title":"Content Security Policy","user":{"login":"bboe","id":48100,"avatar_url":"https://avatars.githubusercontent.com/u/48100?v=3","gravatar_id":"","url":"https://api.github.com/users/bboe","html_url":"https://github.com/bboe","followers_url":"https://api.github.com/users/bboe/followers","following_url":"https://api.github.com/users/bboe/following{/other_user}","gists_url":"https://api.github.com/users/bboe/gists{/gist_id}","starred_url":"https://api.github.com/users/bboe/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bboe/subscriptions","organizations_url":"https://api.github.com/users/bboe/orgs","repos_url":"https://api.github.com/users/bboe/repos","events_url":"https://api.github.com/users/bboe/events{/privacy}","received_events_url":"https://api.github.com/users/bboe/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":{"login":"bboe","id":48100,"avatar_url":"https://avatars.githubusercontent.com/u/48100?v=3","gravatar_id":"","url":"https://api.github.com/users/bboe","html_url":"https://github.com/bboe","followers_url":"https://api.github.com/users/bboe/followers","following_url":"https://api.github.com/users/bboe/following{/other_user}","gists_url":"https://api.github.com/users/bboe/gists{/gist_id}","starred_url":"https://api.github.com/users/bboe/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bboe/subscriptions","organizations_url":"https://api.github.com/users/bboe/orgs","repos_url":"https://api.github.com/users/bboe/repos","events_url":"https://api.github.com/users/bboe/events{/privacy}","received_events_url":"https://api.github.com/users/bboe/received_events","type":"User","site_admin":false},"milestone":null,"comments":0,"created_at":"2016-02-09T23:10:33Z","updated_at":"2016-02-24T02:11:55Z","closed_at":"2016-02-24T02:11:55Z","body":"#### As a security-minded developer I want to obviate all cross site scripting (XSS) attacks.\r\n\r\nA strong content security policy can be used to prevent XSS and other\r\nattacks. With many things security related, it is a good idea to disallow\r\neverything and then allow things only after questioning whether or not they\r\nshould be allowed (a whitelist policy).\r\n\r\nThe most restrictive content security policy is:\r\n\r\n    Content-Security-Policy: default-src 'none';\r\n\r\nHowever this does not permit any stylesheets, images, nor javascript sources\r\nall of which we want to be able to serve up locally, but not inline. The\r\nfollowing accomplishes that task:\r\n\r\n    Content-Security-Policy: default-src 'none'; script-src 'self'; img-src 'self'; style-src 'self';\r\n\r\n\r\nAcceptance criteria:\r\n- [x] Every request outputs an appropriate content security policy header.\r\n- [x] There are no content security policy violations in chrome's console.\r\n- [x] The user interface remains the same.\r\n\r\n\r\nReference material:\r\n- https://www.owasp.org/index.php/Content_Security_Policy_Cheat_Sheet\r\n\r\nDependencies:\r\n- Image Index\r\n"}}