Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Allow gov.uk domains to embed pages #325

Merged
merged 2 commits into from
Oct 9, 2023
Merged

Allow gov.uk domains to embed pages #325

merged 2 commits into from
Oct 9, 2023

Commits on Oct 9, 2023

  1. Allow gov.uk domains to embed pages 

    We initially added the strict and OWASP recommended 'none' directive based on
the assumption that only side-by-side-browser tool (retired in November 2022)
was preventing us from implementing it.

However some other internal GOV.UK apps use iframes:
- Search Admin
    - Best bets (queries)
    - External links (recommended-links)
- Content Publisher (Preview feature)

This policy will still ensure sufficient security yet will allow internal
GOV.UK domains to embed pages.  It's added to the global base policy because
given the number of frontend application it may be difficult to predict which
frontend app renders the page that we want to iframe. It will reduce the need
to apply a CSP modification in individual apps.
    @AgaDufrat
    AgaDufrat committed Oct 9, 2023
    Configuration menu
    Copy the full SHA
    ba97b9d View commit details
    Browse the repository at this point in the history

  2. Release 9.5.0

    @AgaDufrat
    AgaDufrat committed Oct 9, 2023
    Configuration menu
    Copy the full SHA
    08d598a View commit details
    Browse the repository at this point in the history