Extend CSP Configuration

[guspower]

A first pass implementation as discussed in issue #909

Let me know what you think - I'll update the docs when you're happy with it.

[guspower]

Ah I was unaware of the playwright tests - looks like they caught a bug in my implementation. Cool, I will sort it out.

[lovasoa]

Thank you for taking the time to dive in !

This is a good start, but the logic is a little bit wrong here. Each nonce has to be used only once. We cannot define a random nonce on startup and then use it repeatedly. Otherwise an attacker can easily make a script injection that contains the known nonce.

How I think it should work:

• in app_config, we store a parsed csp string. It could be something as simple as struct CSPFormat { before_nonce: String, after_nonce: String }
• add a method to request_context.content_security_policy that takes a CSPFormat and generates a header.
• in render.rs, replace the csp insertion with request_context.content_security_policy.add_to_response(&mut response, app_state.config.content_security_policy)

[guspower]

Yep makes sense +1.

I'll take another run at this tomorrow and ensure each nonce is per-request.

[guspower]

OK this should now be correct (I added an e2e test to verify). Let me know what you think!

[lovasoa]

Done. Thank you @guspower !

[guspower]

Excellent thank you @lovasoa !!!