Skip to content

Use a stricter CSP setting for the API

Heinrich Lee Yu requested to merge 368909-update-csp-for-api into master

What does this MR do and why?

When we upgraded Rails to 6.1.5.1, Rails started adding CSP headers to non-HTML requests.

This change makes the CSP headers for our API endpoints shorter and stricter.

Related to #368909 (closed)

This is also related to gitlab-com/gl-infra/production#7516 (closed) where requests started failing because of large header sizes.

How to set up and validate locally

  1. Make sure CSP is enabled (it is by default)
  2. Open an API request (localhost:3000/api/v4/projects)
  3. Verify the CSP header is set to the new value

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

Edited by Heinrich Lee Yu

Merge request reports