The mobileapps service currently provides a set of default CSP headers. Per @GWicke's suggestion these should be removed in favor of central handling via RESTBase.
(If we decide to override the centrally provided CSP headers later, the restrictions should be tighter than they are currently. )
This is a follow-up task from the content service security review (T109023) -- see the discussion there for further background.
Change 236585 had a related patch set uploaded (by Mholloway):
Security: Remove CSP headers in favor of handling centrally via RESTBase
As reflected on T109023 there is ongoing discussion over how to handle CSP headers and there will likely be changes to the template. Leaving the patch open on Gerrit to rebase over template changes later.
As of PR 333, RESTBase drops the back-end service's CSP headers to the floor if the content is not HTML/SVG. Given that this service's routes all output JSON data (with the exception of mobile-html which will be removed soon anyway), the emitted headers are never received by the end client, so closing this task. The corresponding Gerrit patchset may be abandoned as well.
As a side note, the service template will allow the CSP sending to be configurable once PR 51 is merged.
Change 236585 abandoned by Mholloway:
Security: Remove CSP headers in favor of handling centrally via RESTBase
Reason:
See T111707.