Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[INTERNAL] csp: Update documentation for sap-csp-policies target level increase #792

Merged
merged 2 commits into from
Mar 1, 2023
Merged

[INTERNAL] csp: Update documentation for sap-csp-policies target level increase #792

Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
a35b2a6
[INTERNAL] csp: Update documentation for sap-csp-policies target leve…
flovogt Feb 24, 2023
9346a32
[INTERNAL] Address feedback
matz3 Feb 28, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion docs/pages/Server.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,7 @@ E.g. `/index.html?sap-ui-xx-csp-policy=sap-target-level-1:report-only`

#### The SAPtargetCSP parameter
The default CSP policies can be modified using parameter `sendSAPTargetCSP` (`--sap-csp-policies` when using the CLI).
With `sendSAPTargetCSP` set to `true` the policies `sap-target-level-1` and `sap-target-level-2` policies are activated and send as report-only.
With `sendSAPTargetCSP` set to `true` the policies `sap-target-level-1` and `sap-target-level-3` policies are activated and send as report-only.
Copy link
Member

@codeworrior codeworrior Feb 24, 2023 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

two comments from my side regarding the text outside your change:

  • the title says SAPtargetCSP parameter, but there's no such parameter, it's sendSAPtargetCSP (from a CLI user's perspective)
  • the next paragraph below says
    !!! info This option is available since UI5 CLI v2.3.0

Can't we remove that hint in version 3? I think it was necessary in v2, but v3 it doesn't make much sense to me.

And one comment to the changed text itself:
do we explain the policies anywhere? Other than the name suggests, these are not well-established terms within SAP. We've just picked those names in our code / configuration.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No, I think we currently don't have explanation for the policies. They need to be checked in the code.
I addressed the other two points.


#### Serve CSP Reports

Expand Down