Merge pull request #1656 from coralproject/csp

Disable CSP

docs/source/02-02-advanced-configuration.md

@@ -512,13 +512,14 @@ tracing of GraphQL requests.
 
 **Note: Apollo Engine is a premium service, charges may apply.**
 
-## TALK_ENABLE_STRICT_CSP
+<!-- TODO: re-add CSP once we've resolved issues with dynamic webpack loading. -->
+<!-- ## TALK_ENABLE_STRICT_CSP
 
 Setting this to `TRUE` will enforce the [Content Security Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP)
 (or CSP). By default, this configuration is set to
 [report only](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP#Testing_your_policy)
 where the policy is not enforced, but any violations are reported to a provided
-URI. (Default `FALSE`)
+URI. (Default `FALSE`) -->
 
 ## ALLOW_NO_LIMIT_QUERIES
 

routes/index.js

@@ -9,7 +9,6 @@ const path = require('path');
 const compression = require('compression');
 const plugins = require('../services/plugins');
 const staticTemplate = require('../middleware/staticTemplate');
-const contentSecurityPolicy = require('../middleware/contentSecurityPolicy');
 const nonce = require('../middleware/nonce');
 const staticServer = require('express-static-gzip');
 const { DISABLE_STATIC_SERVER } = require('../config');
@@ -76,7 +75,8 @@ router.use(compression());
 // STATIC ROUTES
 //==============================================================================
 
-const staticMiddleware = [staticTemplate, nonce, contentSecurityPolicy];
+// TODO: re-add CSP once we've resolved issues with dynamic webpack loading.
+const staticMiddleware = [staticTemplate, nonce];
 
 router.use('/admin', ...staticMiddleware, require('./admin'));
 router.use('/account', ...staticMiddleware, require('./account'));

routes/plugins.js

@@ -2,13 +2,12 @@ const express = require('express');
 const debug = require('debug')('talk:routes:plugins');
 const plugins = require('../services/plugins');
 const staticTemplate = require('../middleware/staticTemplate');
-const contentSecurityPolicy = require('../middleware/contentSecurityPolicy');
 const nonce = require('../middleware/nonce');
 
 const router = express.Router();
 
-// Apply the middleware.
-router.use(staticTemplate, nonce, contentSecurityPolicy);
+// TODO: re-add CSP once we've resolved issues with dynamic webpack loading.
+router.use(staticTemplate, nonce);
 
 // Inject server route plugins.
 plugins.get('server', 'router').forEach(plugin => {