Add a content security policy at the application level

[sandbergja]

What maintenance needs to be done?

Add a content security policy header in addition to the current header that comes from nginx.

Level of urgency

• High
• Moderate
• Low

Why is this maintenance needed?

It would provide XSS and Clickjacking protections to users of this application.

Acceptance criteria

• DSS responses include a Content-Security-Policy header set at the application level
• The CSP has object-src 'none';
• The CSP has base-uri 'none';
• The CSP is as restrictive as possible
• The CSP still allows libwizard to embed DSS in iframes
• The UIs still work

Implementation notes, if any

See this documentation about a Strict CSP and MDN's general documentation about CSPs