Skip to content

Use flask-talisman for handling backend response headers#3404

Merged
arikfr merged 8 commits into
masterfrom
talisman
Mar 27, 2019
Merged

Use flask-talisman for handling backend response headers#3404
arikfr merged 8 commits into
masterfrom
talisman

Conversation

@jezdez

@jezdez jezdez commented Feb 6, 2019

Copy link
Copy Markdown
Contributor

Fixes #3060.
Refs #3044.
Refs mozilla#562.
Helps #2891. 🎉

@rauchy

rauchy commented Feb 7, 2019

Copy link
Copy Markdown
Contributor

Thanks @jezdez!

@arikfr if you merge this, we can discard #3214

@jezdez

jezdez commented Feb 7, 2019

Copy link
Copy Markdown
Contributor Author

@rauchy Oh dang, I had missed your PR, apologies for the overlap 😬

@emtwo emtwo left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code looks good to me!

@arikfr arikfr left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks, please see comments.

Comment thread redash/security.py
Comment thread redash/settings/__init__.py Outdated
Comment thread redash/settings/__init__.py Outdated
Comment thread redash/settings/__init__.py
Comment thread requirements.txt Outdated
Comment thread requirements.txt Outdated
Comment thread redash/settings/__init__.py
Comment thread redash/settings/__init__.py Outdated
Comment thread redash/settings/__init__.py Outdated
Comment thread redash/authentication/__init__.py Outdated
Comment thread redash/authentication/__init__.py Outdated
Comment thread redash/settings/__init__.py
@jezdez
jezdez requested a review from arikfr March 7, 2019 11:02
@jezdez
jezdez force-pushed the talisman branch 2 times, most recently from d697222 to bb26cee Compare March 7, 2019 11:07
@jezdez

jezdez commented Mar 21, 2019

Copy link
Copy Markdown
Contributor Author

@arikfr Is there anything needed to merge this?

@jezdez jezdez modified the milestones: v7.0.0, Next Mar 22, 2019
@jezdez

jezdez commented Mar 27, 2019

Copy link
Copy Markdown
Contributor Author

@arikfr Anything needed to merge this?

@arikfr
arikfr merged commit 712fc63 into master Mar 27, 2019
@arikfr
arikfr deleted the talisman branch March 27, 2019 15:24
@arikfr

arikfr commented Mar 27, 2019

Copy link
Copy Markdown
Member

Anything needed to merge this?

Time.

jezdez pushed a commit that referenced this pull request Apr 17, 2019
## What type of PR is this? (check all applicable)

- [x] Bug Fix

## Description

Without this change the Help Drawer couldn't load content anymore.

## Related Tickets & Documents

#3404
harveyrendell pushed a commit to pushpay/redash that referenced this pull request Nov 14, 2019
)

* Normalize Flask initialization API use.

* Use Flask-Talisman.

* Enable HSTS when HTTPS is enforced.

* More details about how CSP is formatted and write CSP directives as a string.

* Use CSP frame-ancestors directive and not X-Frame-Options for embedable endpoints.

* Add link to flask-talisman docs.

* set remember_token cookie to be HTTP-Only and Secure

* Reorganize secret key configuration to be forward thinking and backward compatible.
harveyrendell pushed a commit to pushpay/redash that referenced this pull request Nov 14, 2019
## What type of PR is this? (check all applicable)

- [x] Bug Fix

## Description

Without this change the Help Drawer couldn't load content anymore.

## Related Tickets & Documents

getredash#3404
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants