Add single cookie consent api URLs #355
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
richardTowers
approved these changes
Feb 27, 2024
There was a problem hiding this comment.
Looks good to me. Only thing I wasn't sure about was whether to include the https:// protocol, as the speedcurve link doesn't have that. The documentation suggests it's okay to include that though - https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/Sources#sources
- once the single consent API is enabled on GOV.UK the JS will be making XMLHttprequests to the staging and production environments for the single consent api, so these URLs need to be added to the CSP
andysellick
force-pushed
the
add-consent-api
branch
from
39cf23c to
9a0c956
Compare
|
@richardTowers that's a good point, have updated, thanks! |
|
For future reference, it's slightly better to include https as it means it will only connect on that protocol. Without it will allow non-TLS http. |
|
Thanks @kevindew I hadn't realised that. Should I go back and change this now? |
|
Nah don't worry. I expect at some point in the future, we'll (or I'll) do a blanket update of them. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What / why
Adds the URLs for the single cookie consent API into the CSP. Once the single consent API is enabled on GOV.UK the JS will be making XMLHttprequests to the staging and production environments for the single consent api, so these URLs need to be added to the CSP.
Trello card: https://trello.com/c/dmlTAzKB/140-implement-single-consent-api