{"action":"created","issue":{"url":"https://api.github.com/repos/mozilla/fxa-content-server/issues/3940","repository_url":"https://api.github.com/repos/mozilla/fxa-content-server","labels_url":"https://api.github.com/repos/mozilla/fxa-content-server/issues/3940/labels{/name}","comments_url":"https://api.github.com/repos/mozilla/fxa-content-server/issues/3940/comments","events_url":"https://api.github.com/repos/mozilla/fxa-content-server/issues/3940/events","html_url":"https://github.com/mozilla/fxa-content-server/pull/3940","id":166353726,"number":3940,"title":"WIP fix(server): Allow FxOS 1.3 to sign in/up.","user":{"login":"shane-tomlinson","id":848085,"avatar_url":"https://avatars.githubusercontent.com/u/848085?v=3","gravatar_id":"","url":"https://api.github.com/users/shane-tomlinson","html_url":"https://github.com/shane-tomlinson","followers_url":"https://api.github.com/users/shane-tomlinson/followers","following_url":"https://api.github.com/users/shane-tomlinson/following{/other_user}","gists_url":"https://api.github.com/users/shane-tomlinson/gists{/gist_id}","starred_url":"https://api.github.com/users/shane-tomlinson/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/shane-tomlinson/subscriptions","organizations_url":"https://api.github.com/users/shane-tomlinson/orgs","repos_url":"https://api.github.com/users/shane-tomlinson/repos","events_url":"https://api.github.com/users/shane-tomlinson/events{/privacy}","received_events_url":"https://api.github.com/users/shane-tomlinson/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/mozilla/fxa-content-server/labels/waffle:active","name":"waffle:active","color":"ededed"},{"url":"https://api.github.com/repos/mozilla/fxa-content-server/labels/WIP","name":"WIP","color":"207de5"}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2016-07-19T14:59:01Z","updated_at":"2016-07-20T00:16:59Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/mozilla/fxa-content-server/pulls/3940","html_url":"https://github.com/mozilla/fxa-content-server/pull/3940","diff_url":"https://github.com/mozilla/fxa-content-server/pull/3940.diff","patch_url":"https://github.com/mozilla/fxa-content-server/pull/3940.patch"},"body":"FxOS 1.3 is based on Gecko 18, Gecko < 24 does not recognize\r\nconnectSrc, only xhrSrc. Helmet will convert connectSrc to\r\nxhrSrc for Firefox desktop, but not Firefox Mobile. Add the auth, OAuth,\r\nand profile server URLs to defaultSrc so that users can still\r\nsignin/signup for Marketplace.\r\n\r\nbz1279540\r\nfixes mozilla/fxa-bugzilla-mirror#163\r\n\r\n\r\n----------------------------\r\n\r\ncc @vladikoff and @rfk.\r\nI'm not happy with this because it adds the auth server, oauth server, and profile server URLs to the `defaultSrc`. That's a lot of servers to fall back to for all of the other directives. The newest helmet allows [dynamic directives](https://github.com/helmetjs/csp/blob/50d8dd44bbea9195ad1bf0396a0517cfd6c5e170/index.js#L48) based off of the request, so maybe we can only set these extra values IFF FxOS 1.3. Or, I could file a PR with helmet to convert connectSrc to xhrSrc for [Firefox Mobile as well as Firefox Desktop](https://github.com/helmetjs/csp/blob/50d8dd44bbea9195ad1bf0396a0517cfd6c5e170/lib/transform-directives-for-browser.js#L5)."},"comment":{"url":"https://api.github.com/repos/mozilla/fxa-content-server/issues/comments/233804403","html_url":"https://github.com/mozilla/fxa-content-server/pull/3940#issuecomment-233804403","issue_url":"https://api.github.com/repos/mozilla/fxa-content-server/issues/3940","id":233804403,"user":{"login":"rfk","id":34695,"avatar_url":"https://avatars.githubusercontent.com/u/34695?v=3","gravatar_id":"","url":"https://api.github.com/users/rfk","html_url":"https://github.com/rfk","followers_url":"https://api.github.com/users/rfk/followers","following_url":"https://api.github.com/users/rfk/following{/other_user}","gists_url":"https://api.github.com/users/rfk/gists{/gist_id}","starred_url":"https://api.github.com/users/rfk/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rfk/subscriptions","organizations_url":"https://api.github.com/users/rfk/orgs","repos_url":"https://api.github.com/users/rfk/repos","events_url":"https://api.github.com/users/rfk/events{/privacy}","received_events_url":"https://api.github.com/users/rfk/received_events","type":"User","site_admin":false},"created_at":"2016-07-20T00:16:58Z","updated_at":"2016-07-20T00:16:58Z","body":"> I'm not happy with this because it adds the auth server, oauth server,\r\n> and profile server URLs to the defaultSrc.\r\n\r\nThis feels OK to me as a stop-gap, but yeah, we should try to move away from it."}}
{"actor":{"display_login":"rfk"}}