Add Content Security Policy headers to all jQuery content sites

[timmywil]

Proposed header value

"default-src 'self'; script-src 'self' code.jquery.com; connect-src 'self'; img-src 'self'; style-src 'self';"

This should be tested with a report header first

• Set up an endpoint that can accept security reports

[timmywil]

This also depends on jquery/jquery-wp-content#463

Also, the nginx changes are only being deployed to staging atm.

[Krinkle]

@timmywil Of the three changed roles, only grunt has staging. It seems https://stage.gruntjs.com/ is now down. I guess an nginx syntax error?

[timmywil]

After consulting the docs, I don't see anything obviously wrong with the syntax. Instead, I think the issue has to do with the grunt site's use of proxy_pass. The way to address that seems to have changed over the years, but I think moving add_header to the location block will work. Also, we can add always to the end to ensure the header is sent along even in error responses.

[Krinkle]

@timmywil That didn't seem to bring the site back. I tried logging into the droplet, to check its puppet log and nginx error, but it's not responding to SSH.

Looks like something on 22 Aug (two days before your first patch). Could it be a coincidence?

[Krinkle]

I've rebooted the instance and the site is now back up. Investigation at #60 (unrelated to this).

[timmywil]

Number of CSP reports is very low now. It's getting hard to find legitimate reports. The latest PR covers everything I could find from the last 24 hours. I think once that's merged, we can switch to non-report headers, but leave the logs on to watch for anything I might have missed.

[timmywil]

Need to switch to non-report headers in jquery-wp-content as well, but first we need to test the production sites. That should be quick as I've tested all the staging sites already and the content should match. But, a few wordpress sites do not have staging equivalents (i.e. blogs).

[timmywil]

Remaining items:

• Test CSP on the blog sites. Headers have been deployed, but are not currently showing up. I'll need help looking into why.
• Finish addressing any CSP violations for other wordpress sites.
• Switch the wordpress header to enforced (non-report-only).
• Switch the blogs header to enforced (non-report-only).

Then we can finally call this done, but continue watching logs for anything I missed.