From 84b79f30d7b2fafac5c75955f39fd2e3422fa872 Mon Sep 17 00:00:00 2001 From: Kimmo Puputti Date: Tue, 20 Mar 2018 11:05:23 +0200 Subject: [PATCH 1/2] Add self to the example directive default value --- server/csp.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/server/csp.js b/server/csp.js index 1f1cd7ae..5c2bce2d 100644 --- a/server/csp.js +++ b/server/csp.js @@ -81,7 +81,7 @@ module.exports = (reportUri, enforceSsl, reportOnly) => { // https://content-security-policy.com/ // Example: extend default img directive with custom domain - // const { imgSrc = [] } = defaultDirectives; + // const { imgSrc = [self] } = defaultDirectives; // const exampleImgSrc = imgSrc.concat('my-custom-domain.example.com'); const customDirectives = { From 7add6815c62cf53ca808a4c5589e9722986b3e11 Mon Sep 17 00:00:00 2001 From: Kimmo Puputti Date: Tue, 20 Mar 2018 11:06:07 +0200 Subject: [PATCH 2/2] Add more info to CSP error message --- server/index.js | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/server/index.js b/server/index.js index cad89cdd..f14de977 100644 --- a/server/index.js +++ b/server/index.js @@ -239,10 +239,18 @@ app.get('*', (req, res) => { app.use(log.errorHandler()); if (cspEnabled) { + // Dig out the value of the given CSP report key from the request body. + const reportValue = (req, key) => { + const report = req.body ? req.body['csp-report'] : null; + return report && report[key] ? report[key] : key; + }; + // Handler for CSP violation reports. app.post(cspReportUrl, (req, res) => { - const report = req.body ? req.body['csp-report'] : null; - log.error(new Error('CSP violation'), 'csp-violation', report); + const effectiveDirective = reportValue(req, 'effective-directive'); + const blockedUri = reportValue(req, 'blocked-uri'); + const msg = `CSP: ${effectiveDirective} doesn't allow ${blockedUri}`; + log.error(new Error(msg), 'csp-violation'); res.status(204).end(); }); }