Refactor build and CSP headers for Safari compat (#1442)

* add unsafe-inline directive to style-src

* debugging - turn on csp reporting

* revert reporting only csp

* do not inline JS and CSS in build

* enable HTTPs only when in production mode

* remove debug printf

* fix clean target

* revert force_https removal

server/Makefile

@@ -4,6 +4,7 @@ include ../common.mk
 clean:
 	rm -f common/web/templates/index.html
 	rm -rf common/web/static
+	rm -f common/web/csp-hashes.json
 
 .PHONY: unit-test
 unit-test:

server/eb/app.py

@@ -60,18 +60,17 @@ class WSGIServer(Server):
         script_hashes, style_hashes = WSGIServer.get_csp_hashes(app, app_config)
         csp = {
             "default-src": ["'self'"],
-            "script-src": ["'unsafe-eval'", "'unsafe-inline'"] + script_hashes,
+            "script-src": ["'self'", "'unsafe-eval'", "'unsafe-inline'"] + script_hashes,
+            "style-src": ["'self'", "'unsafe-inline'"] + style_hashes,
             "img-src": ["'self'", "data:"],
             "object-src": ["'none'"],
             "base-uri": ["'none'"],
-            "upgrade-insecure-requests": [""],
             "frame-ancestors": ["'none'"],
             "require-trusted-types-for": ["'script'"],
         }
-        if len(style_hashes) > 0:
-            csp["style-src"] = style_hashes
-        if app_config.server__inline_scripts:
-            csp["script-src"].append("'strict-dynamic'")
+
+        if not app.debug:
+            csp["upgrade-insecure-requests"] = ""
 
         if app_config.server__csp_directives:
             for k, v in app_config.server__csp_directives.items():
@@ -79,7 +78,9 @@ class WSGIServer(Server):
                     v = [v]
                 csp[k] = csp.get(k, []) + v
 
-        Talisman(app, force_https=app_config.server__force_https, frame_options="DENY", content_security_policy=csp)
+        Talisman(
+            app, force_https=app_config.server__force_https, frame_options="DENY", content_security_policy=csp,
+        )
 
     @staticmethod
     def load_static_csp_hashes(app):