colin
/
ploughshares
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix production site issue by removing dynamic CSP function
ci/woodpecker/push/woodpecker Pipeline was successful Details

This commit is contained in:
colin 2025-07-03 18:13:55 -04:00
parent 35f80738a7
commit 767df7dc44
1 changed files with 5 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
docker/ploughshares/app.py
View File

@ -132,17 +132,11 @@ additional_headers = {
'Cross-Origin-Opener-Policy': 'same-origin' 'Cross-Origin-Opener-Policy': 'same-origin'
} }
# Custom function to determine if CSP should be applied # Initialize Talisman with the static CSP configuration
def csp_for_request(): # We'll handle API routes separately in the after_request handler
# Disable CSP for API routes
if request.path.startswith('/api/'):
return None
return ui_csp
# Initialize Talisman with a dynamic CSP function
talisman = Talisman( talisman = Talisman(
app, app,
content_security_policy=csp_for_request, content_security_policy=ui_csp,
content_security_policy_nonce_in=['script-src'], content_security_policy_nonce_in=['script-src'],
feature_policy=permissions_policy, feature_policy=permissions_policy,
force_https=force_https, force_https=force_https,
@ -157,7 +151,7 @@ talisman = Talisman(
session_cookie_http_only=True session_cookie_http_only=True
) )
# Add CORS headers for API routes # Add CORS headers for API routes and handle CSP
@app.after_request @app.after_request
def add_api_headers(response): def add_api_headers(response):
if request.path.startswith('/api/'): if request.path.startswith('/api/'):
@ -167,7 +161,7 @@ def add_api_headers(response):
response.headers['Access-Control-Allow-Headers'] = 'Content-Type, Authorization' response.headers['Access-Control-Allow-Headers'] = 'Content-Type, Authorization'
response.headers['Cross-Origin-Resource-Policy'] = 'cross-origin' response.headers['Cross-Origin-Resource-Policy'] = 'cross-origin'
# Ensure CSP is completely removed for API routes # Remove CSP for API routes to ensure compatibility with clients
if 'Content-Security-Policy' in response.headers: if 'Content-Security-Policy' in response.headers:
del response.headers['Content-Security-Policy'] del response.headers['Content-Security-Policy']
else: else: