Please update CSP with new avatar URL

[clouserw]

Reported on Slack:

Relay is blocking the avatar URL from FxA:

Content Security Policy: The page’s settings blocked the loading of a resource at https://profile.accounts.firefox.com/v1/avatar/w (“img-src”).

Resulting in mis-rendering of the account menu in the top left.

The fix is to add profile.accounts.firefox.com to the img-src CSP rule

[maxxcrawford]

@clouserw I'm having issues recreating this issue. Here's where we set the CSP policy for the profile images. We're using django-csp to manage it. From what I can determine, we're correctly setting the img-src policy.

@tcinotto Can you provide more details on where you were getting this error? I may need to work with you directly to debug/reproduce this.

[clouserw]

It looks like @groovecoder fixed this in abf32ec

If that commit is already live, maybe there is some caching going on? I can still reproduce as of this morning. Steps:

1. Make sure you don't have an avatar in FxA. You can check by logging into accounts.firefox.com. The avatar is the top of the page. If it is unset it should be a letter in a circle.

2. Log in to relay.firefox.com

3. See the missing avatar in the top right of the page. See in console: Content Security Policy: The page’s settings blocked the loading of a resource at https://profile.accounts.firefox.com/v1/avatar/w (“img-src”).

[maxxcrawford]

@clouserw Thanks for the follow up – I had a profile image. Confirmed. I would imagine the caching would no longer be an issue, so I'll keep digging.