Commit 79b02e40 authored by Stan Hu's avatar Stan Hu

Merge branch 'remove-csp-sentry-reporting' into 'master'

Fix the Sentry spam from CSP violations by disabling it.

## What does this MR do?

Leaves CSP enabled, but without a reporting endpoint for now. This was causing a huge amount of useless errors in our Sentry instance.

cc: @stanhu 

See merge request !5354
parents f2cd21e8 38577d68
...@@ -4,14 +4,7 @@ ...@@ -4,14 +4,7 @@
require 'gitlab/current_settings' require 'gitlab/current_settings'
include Gitlab::CurrentSettings include Gitlab::CurrentSettings
# If Sentry is enabled and the Rails app is running in production mode, CSP_REPORT_URI = ''
# this will construct the Report URI for Sentry.
if Rails.env.production? && current_application_settings.sentry_enabled
uri = URI.parse(current_application_settings.sentry_dsn)
CSP_REPORT_URI = "#{uri.scheme}://#{uri.host}/api#{uri.path}/csp-report/?sentry_key=#{uri.user}"
else
CSP_REPORT_URI = ''
end
# Content Security Policy Headers # Content Security Policy Headers
# For more information on CSP see: # For more information on CSP see:
...@@ -71,10 +64,7 @@ SecureHeaders::Configuration.default do |config| ...@@ -71,10 +64,7 @@ SecureHeaders::Configuration.default do |config|
upgrade_insecure_requests: true upgrade_insecure_requests: true
} }
# Reports are sent to Sentry if it's enabled. config.csp[:report_uri] = %W(#{CSP_REPORT_URI})
if current_application_settings.sentry_enabled
config.csp[:report_uri] = %W(#{CSP_REPORT_URI})
end
# Allow Bootstrap Linter in development mode. # Allow Bootstrap Linter in development mode.
if Rails.env.development? if Rails.env.development?
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment