[HOLD][Tracking] CSP error related issues for newDot

[techievivek]

We currently send CSP (content security policy) related headers for newDot using Cloudflare workers, which are only set up for our staging and prod environments. Therefore, testing changes related to CSP on the DEV server is a bit cumbersome. However, we have good news that a whatsnext proposal is in progress, which involves moving the Cloudflare workers code for newDot to the App repo. Until this is done, we kindly request that we keep a pause on working on any issue related to CSP.

If you would like to learn more about CSP, please visit: https://content-security-policy.com/. Additionally, if you're interested in learning more about Cloudflare workers, please visit: https://developers.cloudflare.com/workers/.

For your reference, here are a couple of related issue lists:

• [HOLD #15244] Web - Storybook site - The storybook site opens with error in console #15042
• https://github.com/Expensify/Expensify/issues/246097
• [$1000] Login - Console error when navigating to the homepage #24084

Please feel free to add any issues to the list that are related to the CSP error.

Thank you!

Upwork Automation - Do Not Edit

• Upwork Job URL: https://www.upwork.com/jobs/~0109c13461109f87b5
• Upwork Job ID: 1636794996814442496
• Last Price Increase: 2023-03-17

[MelvinBot]

Triggered auto assignment to @davidcardoza (Bug), see https://stackoverflow.com/c/expensify/questions/14418 for more details.

[techievivek]

Sorry for the ping @davidcardoza, this is just a tracking issue.

[techievivek]

Adding this to weekly until we have some movement in the whatsnext proposal.

[techievivek]

@justinpersaud Hi, any updates on the proposal to move the newDot Cloudflare worker code to the App repo? Will you be working on the project?

[MelvinBot]

@techievivek this issue was created 2 weeks ago. Are we close to a solution? Let's make sure we're treating this as a top priority. Don't hesitate to create a thread in #expensify-open-source to align faster in real time. Thanks!

[techievivek]

No update on the whatsnext proposal but given this is not a big issue for us it should be just fine to hold this for some time.

[techievivek]

Still on HOLD for migration newDot from Cloudflare to our own servers.

[rushatgabhane]

@techievivek spotted a similar error here - #24084

[techievivek]

I chatted with Amy last week about the progress on the project, but it looks like Justine has shifted focus to working on the command mode for the Expensify card project, so this could be a bit delayed for now.

[techievivek]

Still on HOLD.

[techievivek]

No progress seems to be coming from the infra team on switching from the AWS to our own server.

[justinpersaud]

@techievivek can you refresh my memory on why these specifically depend on the migration? Is there nothing we can do today to solve these?

[techievivek]

@justinpersaud
I believe we encountered some CSP errors, as indicated in this GH. To address this, we generated a nonce and added it to our CSP rule in this PR. However, when we deployed these changes, they didn't have the desired effect, and there was no way to test them locally. Consequently, we decided to put all CSP-related issues on hold. The plan was to revisit and resolve these issues once we migrate to our own servers, at which point we'll have a more convenient way to test and rectify these problems.

Here is a current CSP issue that we haven't yet resolved.

[justinpersaud]

there was no way to test them locally.

This isn't true anymore. There is a way to test them locally, we just haven't fully put together the instructions on how to do it because there wasn't a use case.

Also, we have a function now to generate a nonce and have a script that uses it and working today.

https://github.com/Expensify/Cloudflare-Workers/blob/main/new.expensify.com/index.js#L9-L17

It's not clear to me that this needs to be held on any migration and can't be solved another way.

[techievivek]

It's not clear to me that this needs to be held on any migration and can't be solved another way.

This doesn't need to be held of any migration if there is an easy way to test changes made to CSP rule on DEV.

This isn't true anymore. There is a way to test them locally, we just haven't fully put together the instructions on how to do it because there wasn't a use case.

It will be great to have the instruction written on an SO, I can try fixing this once I have a way to test it locally.

Also, we have a function now to generate a nonce and have a script that uses it and working today.
https://github.com/Expensify/Cloudflare-Workers/blob/main/new.expensify.com/index.js#L9-L17

Wow this is cool CONTENT_SECURITY_POLICY.replace('nonce-random-value', nonce-${generateNonce()}). 👌

[justinpersaud]

It will be great to have the instruction written on an SO, I can try fixing this once I have a way to test it locally.

It's a bit more than that. Can you create a GH and assign me with all the requirements you need for your testing? Include details on how you specifically want to test and what you're expecting if possible.

[techievivek]

Sorry, couldn't prioritize this I will take a dig into it and have a GH ready for you soon, thanks.

[techievivek]

Sorry, couldn't prioritize this since I have been working on 2 EOY projects.

[techievivek]

Closing CSP related bugs for now based on this comment #15042 (comment)