[SPIKE] Research Content Security Policy Implementation

[exalate-issue-sync]

Based on https://guides.18f.gov/engineering/security/content-security-policy/

Determine a plan for implementing CSP for our application. Come up with the policies that we want. Determine where to implement it (maybe nginx server). Since the CSP is enforced on the webpage, adding a CSP to the api requests won’t add value there, BUT we might still want to have CSP for the swagger docs which is served by the api rather than the front end server.

Once a plan has been established, update https://fecgov.atlassian.net/browse/FECFILE-1907 and https://fecgov.atlassian.net/browse/FECFILE-1908

Complete by COB Wednesday 22, 2025

QA Notes

null

DEV Notes

null

Design

null

See full ticket and images here: FECFILE-1947

[exalate-issue-sync]

David Heitzer commented: dependent Ticket DEV notes have been updated accordingly with the needed CSP details to implement.