Skip to content

Add videos services to CSP (youtube-nocookie.com, meet.jit.si, etc)#11155

Merged
andreslucena merged 4 commits intodevelopfrom
fix/csp
Jul 28, 2023
Merged

Add videos services to CSP (youtube-nocookie.com, meet.jit.si, etc)#11155
andreslucena merged 4 commits intodevelopfrom
fix/csp

Conversation

@alecslupu
Copy link
Copy Markdown
Contributor

@alecslupu alecslupu commented Jul 11, 2023

🎩 What? Why?

This PR aims to fix more CSP issues introduced by #10700.
The embedded meeting services were not being added to the CSP exception, therefore even though a meeting was in the allowed urls, they may not have worked properly.
Also, this PR fixes #11153, adding the openstreetmap.org to the list of exceptions.

📌 Related Issues

Link your PR to an issue

Testing

Describe the best way to test or validate your PR.

📷 Screenshots

image

♥️ Thank you!

@alecslupu alecslupu marked this pull request as ready for review July 11, 2023 19:17
@alecslupu alecslupu added type: fix PRs that implement a fix for a bug no-backport Pull Requests that should not be backported release: v0.28 Issues or PRs that need to be tackled for v0.28 labels Jul 11, 2023
@andreslucena
Copy link
Copy Markdown
Member

As mentioned in the meeting:

We will not add OSM to the default configuration as that's against their usage: https://operations.osmfoundation.org/policies/tiles/

As our initializer and documentation may not be that clear on this usage policy we should also update that to explain it better (on another PR).

Finally, about the youtube-nocookie and others domains, as they're already allowed by the WYSIWYG video upload feature, we will add them to the default CSP configuration

@alecslupu alecslupu changed the title Fix content security policy Fix meetings content security policy Jul 21, 2023
@alecslupu alecslupu requested a review from a team July 21, 2023 12:47
@andreslucena
Copy link
Copy Markdown
Member

I've changed the fixes to #10986, as that's what I had in mind when commenting that in the review of the original feature:

To add the services that we already handle on the video embed in the default CSP configuration: www.youtube-nocookie.com and player.vimeo.com

@andreslucena andreslucena changed the title Fix meetings content security policy Add external services to meetings' content security policy (youtube-nocookie.com, meet.jit.si, etc) Jul 24, 2023
@andreslucena andreslucena changed the title Add external services to meetings' content security policy (youtube-nocookie.com, meet.jit.si, etc) Add external services to meetings' CSP (youtube-nocookie.com, meet.jit.si, etc) Jul 24, 2023
@andreslucena andreslucena changed the title Add external services to meetings' CSP (youtube-nocookie.com, meet.jit.si, etc) Add services to meetings' CSP (youtube-nocookie.com, meet.jit.si, etc) Jul 24, 2023
@alecslupu alecslupu requested a review from andreslucena July 25, 2023 04:59
@andreslucena andreslucena self-assigned this Jul 26, 2023
@andreslucena andreslucena changed the title Add services to meetings' CSP (youtube-nocookie.com, meet.jit.si, etc) Add videos services to CSP (youtube-nocookie.com, meet.jit.si, etc) Jul 26, 2023
Copy link
Copy Markdown
Member

@andreslucena andreslucena left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👍🏽 Tried it out locally with the 4 services and all work.

@andreslucena andreslucena merged commit b6b024f into develop Jul 28, 2023
@andreslucena andreslucena deleted the fix/csp branch July 28, 2023 06:57
entantoencuanto added a commit that referenced this pull request Jul 28, 2023
* develop:
  Reorder and renumber the RELEASES_NOTES (#11379)
  Add videos services to CSP (youtube-nocookie.com, meet.jit.si, etc) (#11155)
  Alert from frontend errors in critical paths (#10937)
  Redesign: comments issues (#11363)
  Redesign: participatory process steps (#11226)
  Redesign: meetings map (#11383)
  Redesign: rename layouts (#11126)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

no-backport Pull Requests that should not be backported release: v0.28 Issues or PRs that need to be tackled for v0.28 type: fix PRs that implement a fix for a bug

Projects

No open projects
Archived in project

Development

Successfully merging this pull request may close these issues.

Map providers are being blocked by Content Security Policies Rethink the website video embeds

2 participants