Add Content Security Policy headers to all jQuery content sites

[timmywil]

Proposed header value

"default-src 'self'; script-src 'self' code.jquery.com; connect-src 'self'; img-src 'self'; style-src 'self';"

This should be tested with a report header first

• Set up an endpoint that can accept security reports

[timmywil]

This also depends on jquery/jquery-wp-content#463

Also, the nginx changes are only being deployed to staging atm.

[Krinkle]

@timmywil Of the three changed roles, only grunt has staging. It seems https://stage.gruntjs.com/ is now down. I guess an nginx syntax error?

[timmywil]

After consulting the docs, I don't see anything obviously wrong with the syntax. Instead, I think the issue has to do with the grunt site's use of proxy_pass. The way to address that seems to have changed over the years, but I think moving add_header to the location block will work. Also, we can add always to the end to ensure the header is sent along even in error responses.

[Krinkle]

@timmywil That didn't seem to bring the site back. I tried logging into the droplet, to check its puppet log and nginx error, but it's not responding to SSH.

Looks like something on 22 Aug (two days before your first patch). Could it be a coincidence?

[Krinkle]

I've rebooted the instance and the site is now back up. Investigation at #60 (unrelated to this).

[timmywil]

Remaining items:

• Test CSP on the blog sites. Headers have been deployed, but are not currently showing up. I'll need help looking into why.
• Finish addressing any CSP violations for other wordpress sites.
• Switch the wordpress header to enforced (non-report-only).
• Switch the blogs header to enforced (non-report-only).

Then we can finally call this done, but continue watching logs for anything I missed.

[timmywil]

We can finally call this done!

We'll want to double check the CSP report logs when the blogs are switched to jquery-wp-content, but no CSP exceptions should need to be added for the sake of the blog sites. The typekit exceptions won't apply because jquery-wp-content uses a self-hosted font and Timo and I migrated all remote images.