{"action":"created","issue":{"url":"https://api.github.com/repos/ONSdigital/eq-survey-runner/issues/1462","repository_url":"https://api.github.com/repos/ONSdigital/eq-survey-runner","labels_url":"https://api.github.com/repos/ONSdigital/eq-survey-runner/issues/1462/labels{/name}","comments_url":"https://api.github.com/repos/ONSdigital/eq-survey-runner/issues/1462/comments","events_url":"https://api.github.com/repos/ONSdigital/eq-survey-runner/issues/1462/events","html_url":"https://github.com/ONSdigital/eq-survey-runner/pull/1462","id":297150757,"number":1462,"title":"Implement CSP headers","user":{"login":"nealedj","id":356075,"avatar_url":"https://avatars0.githubusercontent.com/u/356075?v=4","gravatar_id":"","url":"https://api.github.com/users/nealedj","html_url":"https://github.com/nealedj","followers_url":"https://api.github.com/users/nealedj/followers","following_url":"https://api.github.com/users/nealedj/following{/other_user}","gists_url":"https://api.github.com/users/nealedj/gists{/gist_id}","starred_url":"https://api.github.com/users/nealedj/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nealedj/subscriptions","organizations_url":"https://api.github.com/users/nealedj/orgs","repos_url":"https://api.github.com/users/nealedj/repos","events_url":"https://api.github.com/users/nealedj/events{/privacy}","received_events_url":"https://api.github.com/users/nealedj/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-02-14T16:03:59Z","updated_at":"2018-02-14T16:32:12Z","closed_at":null,"author_association":"CONTRIBUTOR","pull_request":{"url":"https://api.github.com/repos/ONSdigital/eq-survey-runner/pulls/1462","html_url":"https://github.com/ONSdigital/eq-survey-runner/pull/1462","diff_url":"https://github.com/ONSdigital/eq-survey-runner/pull/1462.diff","patch_url":"https://github.com/ONSdigital/eq-survey-runner/pull/1462.patch"},"body":"### What is the context of this PR?\r\nIn order to mitigate against malicious attacks this PR adds [Flask-Talisman](https://github.com/GoogleCloudPlatform/flask-talisman) to handle the addition of security headers as recommended in the [Flask docs](http://flask-.readthedocs.io/en/latest/security/#security-headers). \r\n\r\nThe main change here is that a [strict-dynamic](https://csp.withgoogle.com/docs/strict-csp.html) CSP header has been added.\r\n\r\nAdditionally Talisman has been extended to generate nonce value for each request that can be added to each request.\r\n\r\n### How to review \r\nRun app and check that the following response headers are present:\r\n- X-Frame-Options: DENY\r\n- X-XSS-Protection: 1; mode=block\r\n- X-Content-Type-Options: nosniff\r\n- Content-Security-Policy: default-src 'self'; script-src 'self' strict-dynamic 'nonce-SOME-PER-REQUEST-NONCE'\r\n- Referrer-Policy: strict-origin-when-cross-origin"},"comment":{"url":"https://api.github.com/repos/ONSdigital/eq-survey-runner/issues/comments/365664171","html_url":"https://github.com/ONSdigital/eq-survey-runner/pull/1462#issuecomment-365664171","issue_url":"https://api.github.com/repos/ONSdigital/eq-survey-runner/issues/1462","id":365664171,"user":{"login":"jonnyshaw89","id":7594012,"avatar_url":"https://avatars0.githubusercontent.com/u/7594012?v=4","gravatar_id":"","url":"https://api.github.com/users/jonnyshaw89","html_url":"https://github.com/jonnyshaw89","followers_url":"https://api.github.com/users/jonnyshaw89/followers","following_url":"https://api.github.com/users/jonnyshaw89/following{/other_user}","gists_url":"https://api.github.com/users/jonnyshaw89/gists{/gist_id}","starred_url":"https://api.github.com/users/jonnyshaw89/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jonnyshaw89/subscriptions","organizations_url":"https://api.github.com/users/jonnyshaw89/orgs","repos_url":"https://api.github.com/users/jonnyshaw89/repos","events_url":"https://api.github.com/users/jonnyshaw89/events{/privacy}","received_events_url":"https://api.github.com/users/jonnyshaw89/received_events","type":"User","site_admin":false},"created_at":"2018-02-14T16:32:12Z","updated_at":"2018-02-14T16:32:12Z","author_association":"CONTRIBUTOR","body":"This looks like a really positive change.\r\nIs there going to be any issues with older browsers?"}}
{"actor":{"display_login":"jonnyshaw89"}}