diff --git a/server/eb/app.py b/server/eb/app.py index 9db9b07f..ca81289f 100644 --- a/server/eb/app.py +++ b/server/eb/app.py @@ -98,11 +98,15 @@ class WSGIServer(Server): server_config = app_config.server_config # This hash should be in sync with the script within # `client/configuration/webpack/obsoleteHTMLTemplate.html` - obsolete_browser_script_hash = ["'sha256-wl4OlniJEAFM1/VNFG/LBDQyPRkO7P/5kfQWf3+fPWE='"] + + # It is _very_ difficult to generate the correct hash manually, + # consider forcing CSP to fail on the local server by intercepting the response via Requestly + # this should print the failing script's hash to console. See more here: https://github.com/chanzuckerberg/cellxgene/pull/1745 + obsolete_browser_script_hash = ["'sha256-/rmgOi/skq9MpiZxPv6lPb1PNSN+Uf4NaUHO/IjyfwM='"] csp = { "default-src": ["'self'"], "connect-src": ["'self'"], - "script-src": ["'self'", "'unsafe-eval'", "'unsafe-inline'"] + "script-src": ["'self'", "'unsafe-eval'"] + obsolete_browser_script_hash + script_hashes, "style-src": ["'self'", "'unsafe-inline'"], "img-src": ["'self'", "https://cellxgene.cziscience.com", "data:"],