@Jseddon Thanks!!

Regarding personal javascript, you mean in User:YourUserName/common.js, right?

For the point on browser tools, you mean the automatic page translation in Chrome? I just tried using that to translate a banner preview, and CSP did indeed flag an error. I wonder if there's something we can do about that? The tool is indeed injecting an external resource into the page.

The script is called from common.js but is stored in another subpage. I actually have move it since to prevent it being an issue which is how I discovered the other issues.

Indeed, I have the google translate extension installed which I use to translate of my own choosing (specifically cause I generally have the chrome auto translate function turned off since it often translates when I dont want it to)

Hmm, this sounds like it would require a per-user setting to whitelist certain sources

Also: check if the report-only version of the header still lets us catch the sources

CSP warnings have now landed in core, should go out on the train pretty soon: https://gerrit.wikimedia.org/r/#/c/253969

T135963: Add support for Content-Security-Policy (CSP) headers in MediaWiki

Hi! There is a workaround for Firefox that lets you turn of CSP entirely. I'd suggest only using it in a special browser profile that you would set up for that purpose.

Eventually this will become a core issue rather than a CN one, once CSP is activated for all WMF wikis. Currently testwiki does emite CSP headers.

The CN header seems more restrictive and less complete than the header sent by the core code on testwiki.

CentralNotice CSP header:

default-src *.wikimedia.org *.wikipedia.org *.wiktionary.org *.wikisource.org *.wikibooks.org *.wikiversity.org *.wikiquote.org *.wikinews.org www.mediawiki.org www.wikidata.org *.wikivoyage.org data: blob: 'self'; script-src *.wikimedia.org 'unsafe-inline' 'unsafe-eval' 'self'; style-src *.wikimedia.org data: 'unsafe-inline' 'self';

Testwiki CSP header:

script-src 'unsafe-eval' 'self' 'nonce-RWQ/6u579GboaQeF7BdZ' meta.wikimedia.org 'unsafe-inline' *.wikipedia.org *.wikinews.org *.wiktionary.org *.wikibooks.org *.wikiversity.org *.wikisource.org wikisource.org *.wikiquote.org www.wikidata.org m.wikidata.org test.wikidata.org *.wikivoyage.org www.mediawiki.org m.mediawiki.org wikimediafoundation.org advisory.wikimedia.org affcom.wikimedia.org auditcom.wikimedia.org boardgovcom.wikimedia.org board.wikimedia.org chair.wikimedia.org checkuser.wikimedia.org collab.wikimedia.org commons.wikimedia.org donate.wikimedia.org exec.wikimedia.org grants.wikimedia.org incubator.wikimedia.org internal.wikimedia.org login.wikimedia.org meta.wikimedia.org movementroles.wikimedia.org office.wikimedia.org otrs-wiki.wikimedia.org outreach.wikimedia.org quality.wikimedia.org searchcom.wikimedia.org spcom.wikimedia.org species.wikimedia.org steward.wikimedia.org strategy.wikimedia.org usability.wikimedia.org wikimaniateam.wikimedia.org am.wikimedia.org ar.wikimedia.org bd.wikimedia.org be.wikimedia.org br.wikimedia.org ca.wikimedia.org cn.wikimedia.org co.wikimedia.org dk.wikimedia.org ec.wikimedia.org et.wikimedia.org fi.wikimedia.org hi.wikimedia.org id.wikimedia.org il.wikimedia.org mai.wikimedia.org mk.wikimedia.org mx.wikimedia.org nl.wikimedia.org noboard-chapters.wikimedia.org no.wikimedia.org nyc.wikimedia.org nz.wikimedia.org pa-us.wikimedia.org pl.wikimedia.org pt.wikimedia.org romd.wikimedia.org rs.wikimedia.org ru.wikimedia.org se.wikimedia.org tr.wikimedia.org ua.wikimedia.org wb.wikimedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&reportonly=1&

@Bawolff, @Ejegg, can and should we switch CN to using the core header, or maybe the core code? Looks like it might work better with gadgets and user scripts (provided those don't load external stuff themselves)?

We may be adjusting the core csp header
Its kind of rediculously long. We also plan on disabling nonces in the initial rollout. So the core stuff should be considered to be in flux

In T193332#4414663, @Bawolff wrote:

So the core stuff should be considered to be in flux

OK thanks...!!! Do you know if, as it is, it allows gadgets and user scripts?

OK thanks...!!! Do you know if, as it is, it allows gadgets and user scripts?

At the moment, it adds a nonce option. This is compatible with some user scripts but not all. We are planning to remove the nonce option from WMF deploys (patch just got merged), so once that's gone it should be compatible with most user scripts. So just remove the 'nonce-RWQ/6u579GboaQeF7BdZ' part (The number changes on every request).

Some people have scripts that load external resources, those will break.

Here's the relevant code in CN:
https://phabricator.wikimedia.org/diffusion/ECNO/browse/wmf_deploy/includes/CentralNoticeHooks.php$399

Currently not seeing the nonce bits when loading with &banner:

Loaded via https://en.wikipedia.org/w/index.php?title=Wikipedia&banner=B2122_0119_enWW_dsk_p1_lg_template&country=US

content-security-policy
script-src 'unsafe-eval' blob: 'self' meta.wikimedia.org *.wikimedia.org *.wikipedia.org *.wikinews.org *.wiktionary.org *.wikibooks.org *.wikiversity.org *.wikisource.org wikisource.org *.wikiquote.org *.wikidata.org *.wikivoyage.org *.mediawiki.org 'unsafe-inline'; default-src 'self' data: blob: upload.wikimedia.org https://commons.wikimedia.org meta.wikimedia.org *.wikimedia.org *.wikipedia.org *.wikinews.org *.wiktionary.org *.wikibooks.org *.wikiversity.org *.wikisource.org wikisource.org *.wikiquote.org *.wikidata.org *.wikivoyage.org *.mediawiki.org wikimedia.org www.pages04.net; style-src 'self' data: blob: upload.wikimedia.org https://commons.wikimedia.org meta.wikimedia.org *.wikimedia.org *.wikipedia.org *.wikinews.org *.wiktionary.org *.wikibooks.org *.wikiversity.org *.wikisource.org wikisource.org *.wikiquote.org *.wikidata.org *.wikivoyage.org *.mediawiki.org wikimedia.org 'unsafe-inline';

Loaded via https://meta.wikimedia.org/w/index.php?title=Wikipedia&banner=B2122_0119_enWW_dsk_p1_lg_template&country=US

content-security-policy
script-src 'unsafe-eval' blob: 'self' meta.wikimedia.org *.wikimedia.org *.wikipedia.org *.wikinews.org *.wiktionary.org *.wikibooks.org *.wikiversity.org *.wikisource.org wikisource.org *.wikiquote.org *.wikidata.org *.wikivoyage.org *.mediawiki.org 'unsafe-inline'; default-src 'self' data: blob: upload.wikimedia.org https://commons.wikimedia.org meta.wikimedia.org *.wikimedia.org *.wikipedia.org *.wikinews.org *.wiktionary.org *.wikibooks.org *.wikiversity.org *.wikisource.org wikisource.org *.wikiquote.org *.wikidata.org *.wikivoyage.org *.mediawiki.org wikimedia.org www.pages04.net; style-src 'self' data: blob: upload.wikimedia.org https://commons.wikimedia.org meta.wikimedia.org *.wikimedia.org *.wikipedia.org *.wikinews.org *.wiktionary.org *.wikibooks.org *.wikiversity.org *.wikisource.org wikisource.org *.wikiquote.org *.wikidata.org *.wikivoyage.org *.mediawiki.org wikimedia.org 'unsafe-inline';