added config for report only mode

config.js

@@ -48,6 +48,11 @@ const CONFIG = {
   // request all of the records. Otherwise, minimum limits of 0 are enforced.
   ALLOW_NO_LIMIT_QUERIES: process.env.TALK_ALLOW_NO_LIMIT_QUERIES === 'TRUE',
 
+  // ONLY_REPORT_CSP_VIOLATIONS disables strict CSP enforcement, and only
+  // reports CSP violations instead of blocking them.
+  ONLY_REPORT_CSP_VIOLATIONS:
+    process.env.TALK_ONLY_REPORT_CSP_VIOLATIONS === 'TRUE',
+
   // LOGGING_LEVEL specifies the logging level used by the bunyan logger.
   LOGGING_LEVEL: ['fatal', 'error', 'warn', 'info', 'debug', 'trace'].includes(
     process.env.TALK_LOGGING_LEVEL

docs/source/02-02-advanced-configuration.md

@@ -497,6 +497,13 @@ tracing of GraphQL requests.
 
 **Note: Apollo Engine is a premium service, charges may apply.**
 
+## TALK_ONLY_REPORT_CSP_VIOLATIONS
+
+Setting this to `TRUE` will enable the [report only](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP#Testing_your_policy)
+mode of the Content Security Policy. The policy is not enforced, but any
+violations are reported to a provided URI. If you are encountering issues with
+resources not loading, try experimenting with this parameter. (Default `FALSE`)
+
 ## ALLOW_NO_LIMIT_QUERIES
 
 Setting this to `TRUE` will allow queries to execute without a limit (returns

middleware/contentSecurityPolicy.js

@@ -1,5 +1,5 @@
 const helmet = require('helmet');
-const { WEBSOCKET_LIVE_URI } = require('../config');
+const { WEBSOCKET_LIVE_URI, ONLY_REPORT_CSP_VIOLATIONS } = require('../config');
 const { BASE_PATH, BASE_URL, STATIC_URL } = require('../url');
 const { URL } = require('url');
 
@@ -46,4 +46,6 @@ module.exports = helmet.contentSecurityPolicy({
     ],
   },
   browserSniff: false,
+  // Allow the configuration to disable strict enforcement of CSP.
+  reportOnly: ONLY_REPORT_CSP_VIOLATIONS,
 });