tree 1113adbcaf58bd2fdac5c1fa64613f47536ba69d
parent a26944168487b0f75158a4cc20e81f5979978fd9
author Jonathan Amsterdam <jba@google.com> 1593029467 -0400
committer Jonathan Amsterdam <jba@google.com> 1593465926 +0000

many: change CSP to use hashes instead of nonces

Change our content security policy (CSP) for scripts.

Instead of using a nonce, which lends itself poorly to caching, use
hashes. See https://csp.withgoogle.com/docs/faq.html, search for "CSP
hashes".

To make hashes work, the hash of every inline script must appear in
our Content-Security-Policy header.

Also, not all browsers support hashing with scripts loaded from files,
so we must dynamically load the files by using an inline script that
builds a script tag with a src attribute. (We need to do this anyway
for the Google Tag Manager script.) See the link above for a
description of the technique. It works because the CSP header mentions
'strict-dynamic', which trusts everything loaded from a trusted
script.

Ideally, we would both generate all these hashes automatically,
and check that they are all correct. This CL doesn't do that.
A followup CL will.

List of changes:

- Replace script tags with scr attributes with inline scripts that
  load from the files.

- In internal/middleware/secureheaders.go, add the list of script
  hashes to the CSP header.

- Remove all references to nonces.

Updates b/159711607.

Change-Id: Ia9b78ecd85e24619e758f2580a370778708b9e71
Reviewed-on: https://go-review.googlesource.com/c/pkgsite/+/239897
Reviewed-by: Roberto Clapis <robclap8@gmail.com>
Reviewed-by: Julie Qiu <julie@golang.org>