fork/cellxgene
1
0
Fork 0
mirror of https://github.com/chanzuckerberg/cellxgene.git synced 2026-10-03 22:58:12 +08:00
Code Issues Packages Projects Releases Wiki Activity

Properly generate hash and provide how-to (#1745)

Browse Source 
* properly generate hash and provide how-to

* Add link to this PR
This commit is contained in:
Severiano Badajoz
2020-08-13 16:50:54 -07:00
committed by GitHub
parent 6848f7a8b2
commit 1c4bb84f35
1 changed files with 6 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/eb/app.py
+6 -2
View File
@@ -98,11 +98,15 @@ class WSGIServer(Server):
server_config = app_config.server_config server_config = app_config.server_config
# This hash should be in sync with the script within # This hash should be in sync with the script within
# `client/configuration/webpack/obsoleteHTMLTemplate.html` # `client/configuration/webpack/obsoleteHTMLTemplate.html`
obsolete_browser_script_hash = ["'sha256-wl4OlniJEAFM1/VNFG/LBDQyPRkO7P/5kfQWf3+fPWE='"]
# It is _very_ difficult to generate the correct hash manually,
# consider forcing CSP to fail on the local server by intercepting the response via Requestly
# this should print the failing script's hash to console. See more here: https://github.com/chanzuckerberg/cellxgene/pull/1745
obsolete_browser_script_hash = ["'sha256-/rmgOi/skq9MpiZxPv6lPb1PNSN+Uf4NaUHO/IjyfwM='"]
csp = { csp = {
"default-src": ["'self'"], "default-src": ["'self'"],
"connect-src": ["'self'"], "connect-src": ["'self'"],
"script-src": ["'self'", "'unsafe-eval'", "'unsafe-inline'"] "script-src": ["'self'", "'unsafe-eval'"]
+ obsolete_browser_script_hash + script_hashes, + obsolete_browser_script_hash + script_hashes,
"style-src": ["'self'", "'unsafe-inline'"], "style-src": ["'self'", "'unsafe-inline'"],
"img-src": ["'self'", "https://cellxgene.cziscience.com", "data:"], "img-src": ["'self'", "https://cellxgene.cziscience.com", "data:"],