From fc6c73110b27b4acb0d1ff72dec2e1439eccd931 Mon Sep 17 00:00:00 2001 From: Jesse Hallam Date: Mon, 8 Mar 2021 12:49:10 -0400 Subject: [PATCH] set CSP unsafe-inline during development (#17079) * set CSP unsafe-inline during development Extensions in Firefox are hampered by a [long-standing bug](https://bugzilla.mozilla.org/show_bug.cgi?id=1267027) that (incorrectly) applies CSP to content scripts injected by extensions. This precludes the ability to use the React and Redux DevTools in Firefox. When in dev mode, add `unsafe-inline` to the CSP directives to unlock the use of these extdensions. * Less specific GitHub link Co-authored-by: Mattermod --- web/handlers.go | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/web/handlers.go b/web/handlers.go index 0f5a4d17d4..15675878f9 100644 --- a/web/handlers.go +++ b/web/handlers.go @@ -177,7 +177,13 @@ func (h Handler) ServeHTTP(w http.ResponseWriter, r *http.Request) { // Add unsafe-eval to the content security policy for faster source maps in development mode devCSP := "" if model.BuildNumber == "dev" { - devCSP = " 'unsafe-eval'" + devCSP += " 'unsafe-eval'" + } + + // Add unsafe-inline to unlock extensions like React & Redux DevTools in Firefox + // see https://github.com/reduxjs/redux-devtools/issues/380 + if model.BuildNumber == "dev" { + devCSP += " 'unsafe-inline'" } // Set content security policy. This is also specified in the root.html of the webapp in a meta tag.