Merge pull request #9785 from Expensify/revert-9738-fix-frameCSP

Revert "[Prod QA] Fix CSP for statement frames on Desktop"
Expensify · Jul 8, 2022 · 4c60382 · 4c60382
2 parents 3ae2a4d + e0dee96
commit 4c60382
Showing 1 changed file with 11 additions and 13 deletions.
diff --git a/desktop/main.js b/desktop/main.js
@@ -47,7 +47,6 @@ _.assign(console, log.functions);
 // until it detects that it has been upgraded to the correct version.
 
 const EXPECTED_UPDATE_VERSION_FLAG = '--expected-update-version';
-const APP_DOMAIN = __DEV__ ? `http://localhost:${port}` : 'app://*';
 
 let expectedUpdateVersion;
 for (let i = 0; i < process.argv.length; i++) {
@@ -160,19 +159,18 @@ const mainWindow = (() => {
                     details.requestHeaders.referer = CONFIG.EXPENSIFY.URL_EXPENSIFY_CASH;
                     callback({requestHeaders: details.requestHeaders});
                 });
-            }
 
-            // Modify access-control-allow-origin header and CSP for the response
-            webRequest.onHeadersReceived(validDestinationFilters, (details, callback) => {
-                details.responseHeaders['access-control-allow-origin'] = [APP_DOMAIN];
-                if (details.responseHeaders['content-security-policy']) {
-                    details.responseHeaders['content-security-policy'] = _.map(
-                        details.responseHeaders['content-security-policy'],
-                        value => (value.startsWith('frame-ancestors') ? `${value} ${APP_DOMAIN}` : value),
-                    );
-                }
-                callback({responseHeaders: details.responseHeaders});
-            });
+                // Modify access-control-allow-origin header for the response
+                webRequest.onHeadersReceived(validDestinationFilters, (details, callback) => {
+                    details.responseHeaders['access-control-allow-origin'] = ['app://-'];
+                    callback({responseHeaders: details.responseHeaders});
+                });
+            } else {
+                webRequest.onHeadersReceived(validDestinationFilters, (details, callback) => {
+                    details.responseHeaders['access-control-allow-origin'] = [`http://localhost:${process.env.PORT}`];
+                    callback({responseHeaders: details.responseHeaders});
+                });
+            }
             /* eslint-enable */
 
             // Prod and staging overwrite the app name in the electron-builder config, so only update it here for dev