Checklist: CSP #

This page is for designers and developers who make sure a design works under an enforced Content Security Policy. Background: CSP-safe design.

Contents #

1. Templates
2. Scripts and styles
3. Origins
4. Before enforcing

Templates #

• To do: No <script> element with code (a src script, a JSON data block and a <template> are fine).
• To do: No on*= handler attributes.
• To do: No javascript: URLs.
• To do: No <style> blocks and no style="" attributes (No inline CSS).
• To do: csp_nonce() only where a file is truly impossible, and never inside a cache-block or a view-cached template.

grep -rn -E "<script>|on(click|change|load|submit|input|keyup|keydown|focus|blur|mouseover)=|javascript:|<style|style=\"" \
     extension/mytheme/design --include=*.tpl

Scripts and styles #

• To do: Every script is a file under javascript/, loaded with the ezjscore operators (No inline JavaScript).
• To do: Values for scripts come from data-* attributes or <script type="application/json"> blocks.
• To do: Code that must run before the first paint is a small file loaded in the head.
• To do: No eval, new Function or string arguments to setTimeout in the design's scripts.

Origins #

• To do: Every third-party origin the design needs is listed in the theme's README, with the directive it needs.
• To do: Fonts, icons and libraries are local unless there is a reason.

Before enforcing #

• To do: The siteaccess ran with [ContentSecurityPolicy] Mode=report-only while every page type and every dialog was used.
• To do: The browser console and var/log/csp.log (with ReportEndpoint=enabled) show no reports for the design.
• To do: For admin designs and extensions: AdminContentSecurityPolicyTest and ExtensionInlineScriptsTest pass.
• To do: Then Mode=enforce on one siteaccess first, INI cache cleared, PHP reloaded.

Related pages #

• CSP-safe design
• Content Security Policy
• Free documentation: this page is free to copy, translate and improve under the GNU FDL 1.3.