Update CSP addon.

[rwjblue]

Now uses Content-Security-Policy-Report-Only by default.

[stefanpenner]

:( lets aim to transition this from report back to strict at some future point in time when we have more edge cases worked out.

[rwjblue]

Agreed.

I believe that reporting is a step up from nothing, and is more likely to get folks to keep the addon enabled (because it doesn't break their apps).

[ahacking]

Definitely support report only. It also allows one to capture the CSP they
need through test coverage.

Now thinking out load that would be useful feature to be able to generate a
draft CSP based on the violations, it may well come to that as you don't
want to continuously report the same violation. Once the middleware is
getting violation reports it could merge the violation into the active CSP
and report the new computed CSP on the console.
On Oct 5, 2014 8:44 AM, "Robert Jackson" notifications@github.com wrote:

Agreed.

I believe that reporting is a step up from nothing, and is more likely to
get folks to keep the addon enabled (because it doesn't break their apps).

—
Reply to this email directly or view it on GitHub
#2190 (comment)
.

[Globegitter]

I agree it's good to have it as report only to getting people used to what CSP and doesn't just break their app (even if it is just an addon) and once it's been out there for a while, people are more used to it and it has been improved in certain cases it can be switched back.