From 1c4bb84f35e7b4782ed2bb37d17f1f0de8306e2f Mon Sep 17 00:00:00 2001 From: Severiano Badajoz Date: Thu, 13 Aug 2020 16:50:54 -0700 Subject: [PATCH] Properly generate hash and provide how-to (#1745) * properly generate hash and provide how-to * Add link to this PR --- server/eb/app.py | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/server/eb/app.py b/server/eb/app.py index 9db9b07f..ca81289f 100644 --- a/server/eb/app.py +++ b/server/eb/app.py @@ -98,11 +98,15 @@ class WSGIServer(Server): server_config = app_config.server_config # This hash should be in sync with the script within # `client/configuration/webpack/obsoleteHTMLTemplate.html` - obsolete_browser_script_hash = ["'sha256-wl4OlniJEAFM1/VNFG/LBDQyPRkO7P/5kfQWf3+fPWE='"] + + # It is _very_ difficult to generate the correct hash manually, + # consider forcing CSP to fail on the local server by intercepting the response via Requestly + # this should print the failing script's hash to console. See more here: https://github.com/chanzuckerberg/cellxgene/pull/1745 + obsolete_browser_script_hash = ["'sha256-/rmgOi/skq9MpiZxPv6lPb1PNSN+Uf4NaUHO/IjyfwM='"] csp = { "default-src": ["'self'"], "connect-src": ["'self'"], - "script-src": ["'self'", "'unsafe-eval'", "'unsafe-inline'"] + "script-src": ["'self'", "'unsafe-eval'"] + obsolete_browser_script_hash + script_hashes, "style-src": ["'self'", "'unsafe-inline'"], "img-src": ["'self'", "https://cellxgene.cziscience.com", "data:"],