fix: Allow Connection to Hubspot #633
Conversation
server/ecs/app.py
Outdated
| "default-src": ["'self'"], | ||
| "connect-src": ["'self'", PLAUSIBLE_URL] + extra_connect_src, | ||
| "script-src": ["'self'", "'unsafe-eval'", PLAUSIBLE_URL] + script_hashes, | ||
| "default-src": ["'self'", HUBSPOT_FORMS_URL], |
There was a problem hiding this comment.
Seems like if we have the form URL in default src, the URL won't need to be in other directives 😄?
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/default-src
There was a problem hiding this comment.
Don't think this worked so I'm trying to explicitly put it in the other directives in this new PR :^]
Codecov Report
@@ Coverage Diff @@
## main #633 +/- ##
=======================================
Coverage 77.67% 77.67%
=======================================
Files 88 88
Lines 6754 6754
=======================================
Hits 5246 5246
Misses 1508 1508
Flags with carried forward coverage won't be shown. Click here to find out more. 📣 We’re building smart automated test selection to slash your CI/CD build times. Learn more |
So maybe something like this? It's weird because can't really test it locally 😅 |
* feat: Newsletter Banner (#601) * feat: Newsletter Banner * fix: Allow Connection to Hubspot (#633) * fix: Allow Connection to Hubspot * moving to default-src * adding form-action * fix: Modify CSP to Allow Hubspot (#634) --------- Co-authored-by: Andrew Shin <[email protected]>
* feat: Newsletter Banner (#601) * feat: Newsletter Banner * fix: Allow Connection to Hubspot (#633) * fix: Allow Connection to Hubspot * moving to default-src * adding form-action * fix: Modify CSP to Allow Hubspot (#634) --------- Co-authored-by: Andrew Shin <[email protected]>
Cannot make a request to Hubspot
modifying headers to match GE: https://github.com/chanzuckerberg/single-cell-data-portal/pull/4679/files#diff-e064de65d4610383e665a32e7e32ee1f520c466a6a63ecea8925ff8337f08215:~:text=frontend/next.config.js