fix: revert CSP header and script-src addition

[AtofStryker]

• Reopens Figure out how to load site with Content-Security-Policy without stripping header #1030

User facing changelog

N/A. Reverts feature.

Additional details

After merging #24760, the development team noticed that there were regressions in some of the authentication providers that were previously supported. This is mainly due to no longer stripping CSP headers, as well as potentially overwriting them.

In the current state, #24760 overwrites current CSP headers. This is an issue with Salesforce domains for example, where Content-Security-Policy=upgrade-insecure-requests becomes Content-Security-Policy=script-src 'nonce-<NONCE>'. Since script-src itself is then required for even inline scripts, unsafe keywords would likely be required. The desired behavior here would likely be to not modify this header in this case since script-src is not present, and if it is present, we would need these nonces to likely be added to each inline script, probably overwriting the previous nonce. Adding script-src to injected html files is likely more involved than previously thought.

Another issue that is now present with this feature is CSP headers that are not compatible with Cypress. For instance, Auth0 provides Content-Security-Policy='frame-ancestors 'none', which has the same effect as X-Frame-Options='deny'. This means that the site cannot load in an iframe, which is inherently incompatible with Cypress

In the near future, we need to investigate what CSP policies might be a problem with Cypress, as well as how to support script nonce injection with Cypress if the CSP policy is present. Is is likely a good idea once these are vetted and discovered that we add some system tests that verify the rewrite behavior is correct and that sites load properly when visited.

Steps to test

N/A, revert

How has the user experience changed?

PR Tasks

• Have tests been added/updated?
• Has the original issue (or this PR, if no issue exists) been tagged with a release in ZenHub? (user-facing changes only)
• Has a PR for user-facing changes been opened in cypress-documentation?
• Have API changes been updated in the type definitions?

[cypress]

---

Test summary

4278 • 0 • 830 • 0 • 7

---

Run details

Project	cypress
Status	Passed
Commit	b4d8ecd
Started	Jan 13, 2023 3:45 PM
Ended	Jan 13, 2023 4:00 PM
Duration	15:34 💡
OS	Linux Debian -
Browser	WebKit 16

View run in Cypress Dashboard ➡️

---

Flakiness

	commands/net_stubbing.cy.ts		4
1	network stubbing > intercepting request > can delay and throttle a StaticResponse
2	... > with `times` > only uses each handler N times
3	network stubbing > waiting and aliasing > can timeout waiting on a single response using "alias"
4	... > stops waiting when an xhr request is canceled
	cypress/cypress.cy.js		1
1	... > correctly returns currentRetry
This comment includes only the first 5 flaky tests. See all 7 flaky tests in the Cypress Dashboard.

---

This comment has been generated by cypress-bot as a result of this project's GitHub integration settings. You can manage this integration in this project's settings in the Cypress Dashboard

[flotwig]

In the current state, #24760 overwrites current CSP headers. This is an issue with Salesforce domains for example, where Content-Security-Policy=upgrade-insecure-requests becomes Content-Security-Policy=script-src 'nonce-'.

Not that this fixes the other problems with frame-ancestor etc., but #24760 shouldn't have caused the CSP to be overwritten, only extended... so I'd expect this to become upgrade-insecure-requests; script-src 'nonce-<NONCE>'. Agree with everything else here.

[AtofStryker]

In the current state, #24760 overwrites current CSP headers. This is an issue with Salesforce domains for example, where Content-Security-Policy=upgrade-insecure-requests becomes Content-Security-Policy=script-src 'nonce-'.

Not that this fixes the other problems with frame-ancestor etc., but #24760 shouldn't have caused the CSP to be overwritten, only extended... so I'd expect this to become upgrade-insecure-requests; script-src 'nonce-<NONCE>'. Agree with everything else here.

I think the overwriting here is a bug. It looks like let policy = cspRegExp.exec('upgrade-insecure-requests') returns null here, when it should be able to parse the header. In the other cases I have seen, script-src is appended to the CSP, which may cause side effects.