tree 3df47efcfb13bdd3bf63b53af6a18c761951a1ad
parent fbe5e95f5fb8840efba59f2d344bd25b0f55854b
author Andrew Bonventre <andybons@golang.org> 1588282663 -0400
committer Andrew Bonventre <andybons@google.com> 1588284651 +0000

internal/middleware: update CSP headers to allow Google Analytics

When JavaScript is disallowed, the <noscript> Google Analytics
iFrame is the fallback, but this requires that the frame-src CSP
directive is set.

On Safari, it will disallow calls to the collect endpoint without
a valid connect-src directive.

Also updates the base-uri directive since the site does not use the
base tag and omitting it allows any value to be set.

Update b/154628605

Change-Id: I07e0dbeed3372b7c911af2c202a43108d2ca950a
Reviewed-on: https://team-review.git.corp.google.com/c/golang/discovery/+/733460
CI-Result: Cloud Build <devtools-proctor-result-processor@system.gserviceaccount.com>
Reviewed-by: Julie Qiu <julieqiu@google.com>