Add __cspreport__ endpoint?

[leplatrem]

Especially if the kinto-admin plugin is enabled?

• https://hacks.mozilla.org/2016/02/implementing-content-security-policy/

• See Security Checklist mozilla-services/kinto-dist#108

[g-k]

It might be useful in dev.

For stage and prod, we usually have nginx log to a file:

    location /__cspreport__ {
        access_log /media/ephemeral0/nginx/logs/CSP.log CSP;
        proxy_pass http://127.0.0.1/csp-proxy;
    }

    location /csp-proxy {
      access_log off;
      return 204;
      allow 127.0.0.1;
      deny all;
    }

or nginx w/ openresty:

    location = /__cspreport__ {
        access_log /media/ephemeral0/nginx/logs/CSP.log CSP;
        lua_need_request_body on;
        rewrite_by_lua 'ngx.exit(204)';
    }

[leplatrem]

Thanks for your feedback!

According to what I read here, the POST data should be logged too no?

I guess it makes sense to have this endpoint in Kinto if the Content-Security-Policy header is set here too (to assure report-uri value consistency).

So at least we can document the nginx configuration in the production docs, so let's keep this issue opened :)