Skip to content

Use flask-talisman for handling backend response headers#3404

Merged
arikfr merged 8 commits intomasterfrom
talisman
Mar 27, 2019
Merged

Use flask-talisman for handling backend response headers#3404
arikfr merged 8 commits intomasterfrom
talisman

Conversation

@jezdez
Copy link
Copy Markdown
Contributor

@jezdez jezdez commented Feb 6, 2019

Fixes #3060.
Refs #3044.
Refs mozilla#562.
Helps #2891. 🎉

@rauchy
Copy link
Copy Markdown
Contributor

rauchy commented Feb 7, 2019

Thanks @jezdez!

@arikfr if you merge this, we can discard #3214

@jezdez
Copy link
Copy Markdown
Contributor Author

jezdez commented Feb 7, 2019

@rauchy Oh dang, I had missed your PR, apologies for the overlap 😬

Copy link
Copy Markdown

@emtwo emtwo left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code looks good to me!

Copy link
Copy Markdown
Member

@arikfr arikfr left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks, please see comments.

Comment thread redash/security.py
Comment thread redash/settings/__init__.py Outdated
Comment thread redash/settings/__init__.py Outdated
Comment thread redash/settings/__init__.py
Comment thread requirements.txt Outdated
Comment thread requirements.txt Outdated
Comment thread redash/settings/__init__.py
Comment thread redash/settings/__init__.py Outdated
Comment thread redash/settings/__init__.py Outdated
Comment thread redash/authentication/__init__.py Outdated
Comment thread redash/authentication/__init__.py Outdated
Comment thread redash/settings/__init__.py
@jezdez jezdez requested a review from arikfr March 7, 2019 11:02
@jezdez jezdez force-pushed the talisman branch 2 times, most recently from d697222 to bb26cee Compare March 7, 2019 11:07
@jezdez
Copy link
Copy Markdown
Contributor Author

jezdez commented Mar 21, 2019

@arikfr Is there anything needed to merge this?

@jezdez jezdez modified the milestones: v7.0.0, Next Mar 22, 2019
@jezdez
Copy link
Copy Markdown
Contributor Author

jezdez commented Mar 27, 2019

@arikfr Anything needed to merge this?

@arikfr arikfr merged commit 712fc63 into master Mar 27, 2019
@arikfr arikfr deleted the talisman branch March 27, 2019 15:24
@arikfr
Copy link
Copy Markdown
Member

arikfr commented Mar 27, 2019

Anything needed to merge this?

Time.

jezdez pushed a commit that referenced this pull request Apr 17, 2019
## What type of PR is this? (check all applicable)

- [x] Bug Fix

## Description

Without this change the Help Drawer couldn't load content anymore.

## Related Tickets & Documents

#3404
harveyrendell pushed a commit to pushpay/redash that referenced this pull request Nov 14, 2019
)

* Normalize Flask initialization API use.

* Use Flask-Talisman.

* Enable HSTS when HTTPS is enforced.

* More details about how CSP is formatted and write CSP directives as a string.

* Use CSP frame-ancestors directive and not X-Frame-Options for embedable endpoints.

* Add link to flask-talisman docs.

* set remember_token cookie to be HTTP-Only and Secure

* Reorganize secret key configuration to be forward thinking and backward compatible.
harveyrendell pushed a commit to pushpay/redash that referenced this pull request Nov 14, 2019
## What type of PR is this? (check all applicable)

- [x] Bug Fix

## Description

Without this change the Help Drawer couldn't load content anymore.

## Related Tickets & Documents

getredash#3404
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants