CSP reports don't get reported locally if using a contextPath

[labkey-adam]

Rationale

https://www.labkey.org/home/Developer/issues/issues-details.view?issueId=53319

Adding the context path to the report-uri does the trick -- tested both with and without a context path. Note: for this to work correctly, any provided contextPath value must start with a slash. Credit to @labkey-tchad for current approach.

Related Pull Requests

• Include contextPath in CSP 'report-uri' #1103

[labkey-matthewb]

On second thought, this might not be right. This CSP will also be used for static pages. In that case this might be a nonsense URL. E.g. looks like an ActionURL with an improper container path.

[labkey-tchad]

The CSPs in application.properties are only used for dev enlistments, which use a root contextPath without some modification to the file. If they do that, I think it's reasonable to expect them to modify the CSP as well.

The CSP defined in Java has access to the contextPath and could just include it in the CSP's report-uri, right?

[labkey-tchad]

Spring boot support property interpolation. If we prepend the report URI with ${context.contextPath:}, it will fill in the context path (if it is defined)

[labkey-adam]

The CSPs in application.properties are only used for dev enlistments, which use a root contextPath without some modification to the file. If they do that, I think it's reasonable to expect them to modify the CSP as well.

The CSP defined in Java has access to the contextPath and could just include it in the CSP's report-uri, right?

Given that these are dev-only and short lived (removed starting in 25.6), and the fact that @labkey-willm automation relies on this URI (I think), I'm going to leave the application.properties URIs as is.

[labkey-adam]

On second thought, this might not be right. This CSP will also be used for static pages. In that case this might be a nonsense URL. E.g. looks like an ActionURL with an improper container path.

Approach was changed to continue to use an absolute URI but explicitly include the context path