Flip CSP from report-only to enforce after bake-in #3274

New issue

Open

opened 2026-05-12 06:26:28 +00:00 by mfreeman451 · 0 comments

mfreeman451 commented

2026-05-12 06:26:28 +00:00

Owner

Background

add-platform-security-hardening (merged) ships CSP in
report-only mode by default:

# elixir/web-ng/config/config.exs
config :serviceradar_web_ng, ServiceRadarWebNGWeb.Plugs.SecurityHeaders,
  csp_mode: :report_only,
  csp_report_uri: "/api/security/csp-report"

CSP violations are recorded as :csp_violation SecurityEvents
(surfaced in Settings → Audit → Events). Browsers emit reports but
the page renders normally.

The follow-on operator step is to flip csp_mode to :enforce
after the report-only bake-in window. The rollout runbook
(docs/PLATFORM_SECURITY_HARDENING.md §1) describes the cutover
gate as: "after ≥ 7 days of clean report-only data, flip CSP to
enforce via runtime config."

What this issue tracks

This is a deployment / operator task, not a code change.

Observe Settings → Audit → Events filtered to
kind = :csp_violation for at least 7 days after the
add-platform-security-hardening rollout reaches production.
Resolve any genuine violations:
- Whitelist additional sources in @csp /@api_docs_csp
  in elixir/web-ng/lib/serviceradar_web_ng_web/router.ex.
- Move inline scripts/styles to assets where possible.
- Mark known-safe extension-driven violations as ignored.
Once reports are clean for the bake-in window, set
csp_mode: :enforce in config/runtime.exs (or via env-var
override). Keep the csp_report_uri in place — enforced CSP
still emits reports for the bits the browser blocked, which
gives ongoing visibility.

Escape hatch

If enforce-mode breaks a route that needs to load third-party
content, flip back to :report_only via runtime config without
a redeploy. Documented in
docs/PLATFORM_SECURITY_HARDENING.md §5.

References

add-platform-security-hardening (merged): introduced the
CSP report-only mode + report endpoint.
docs/PLATFORM_SECURITY_HARDENING.md §1 (rollout) and §5
(CSP escape hatch).
elixir/web-ng/lib/serviceradar_web_ng_web/plugs/security_headers.ex
for the toggle implementation.

## Background `add-platform-security-hardening` (merged) ships CSP in **report-only** mode by default: ```elixir # elixir/web-ng/config/config.exs config :serviceradar_web_ng, ServiceRadarWebNGWeb.Plugs.SecurityHeaders, csp_mode: :report_only, csp_report_uri: "/api/security/csp-report" ``` CSP violations are recorded as `:csp_violation` SecurityEvents (surfaced in Settings → Audit → Events). Browsers emit reports but the page renders normally. The follow-on operator step is to flip `csp_mode` to `:enforce` after the report-only bake-in window. The rollout runbook (`docs/PLATFORM_SECURITY_HARDENING.md` §1) describes the cutover gate as: "after ≥ 7 days of clean report-only data, flip CSP to enforce via runtime config." ## What this issue tracks This is a **deployment / operator** task, not a code change. 1. Observe `Settings → Audit → Events` filtered to `kind = :csp_violation` for at least 7 days after the add-platform-security-hardening rollout reaches production. 2. Resolve any genuine violations: - Whitelist additional sources in `@csp` /`@api_docs_csp` in `elixir/web-ng/lib/serviceradar_web_ng_web/router.ex`. - Move inline scripts/styles to assets where possible. - Mark known-safe extension-driven violations as ignored. 3. Once reports are clean for the bake-in window, set `csp_mode: :enforce` in `config/runtime.exs` (or via env-var override). Keep the `csp_report_uri` in place — enforced CSP still emits reports for the bits the browser blocked, which gives ongoing visibility. ## Escape hatch If enforce-mode breaks a route that needs to load third-party content, flip back to `:report_only` via runtime config without a redeploy. Documented in `docs/PLATFORM_SECURITY_HARDENING.md` §5. ## References - `add-platform-security-hardening` (merged): introduced the CSP report-only mode + report endpoint. - `docs/PLATFORM_SECURITY_HARDENING.md` §1 (rollout) and §5 (CSP escape hatch). - `elixir/web-ng/lib/serviceradar_web_ng_web/plugs/security_headers.ex` for the toggle implementation.

mfreeman451 referenced this issue from a commit

2026-05-12 06:27:09 +00:00

OpenSpec: archive add-platform-security-hardening