update CSP setting

[ChunxiAlexLuo]

Refs:

• https://github.com/stolostron/backlog/issues/23853
• https://github.com/stolostron/backlog/issues/23854

Signed-off-by: Chunxi Luo chuluo@redhat.com

[sonarcloud]

Kudos, SonarCloud Quality Gate passed!   

0 Bugs
0 Vulnerabilities
0 Security Hotspots
0 Code Smells

No Coverage information
No Duplication information

[pshickeydev]

@ChunxiAlexLuo while the CSP is good, the X-XSS-Protection (even if largely deprecated) I expect will be a problem for the customer. The CSP may prevent XSS, but the Protection header certainly shouldn't be set to disabled.
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection

I'm also not an owner so my approval will not trigger any merge.

[ChunxiAlexLuo]

@ChunxiAlexLuo while the CSP is good, the X-XSS-Protection (even if largely deprecated) I expect will be a problem for the customer. The CSP may prevent XSS, but the Protection header certainly shouldn't be set to disabled. https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection

I'm also not an owner so my approval will not trigger any merge.

I also noticed this before this PR and found the helmet default disable X-XSS-Protection, if you think there is a need I can try to enable it in the helmet. helmetjs/helmet#230

Just let you review and if you think it is LGTM then @dhaiducek or @JustinKuli can approve it

[pshickeydev]

Checking the triage doc it looks like X-XSS-Protection was not a header they were concerned with.
/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: ChunxiAlexLuo, dhaiducek, pshickeydev

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [ChunxiAlexLuo,dhaiducek]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[pshickeydev]

Determined in https://github.com/stolostron/backlog/issues/23853#issuecomment-1198611555 that this PR does not address issue #23853