From 8b41e53028703e2d90bc8f79bf3676d69266cef1 Mon Sep 17 00:00:00 2001 From: Moonchild Date: Tue, 18 Feb 2025 10:03:17 +0100 Subject: [PATCH] Issue #2693 - Disable CSP reporting by default in the platform. This is a temporary measure to work around CF OOM situations. Reporting is desirable normally so webmasters get alerted to CSP issues, and this should be flipped back on once we can. --- modules/libpref/init/all.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/libpref/init/all.js b/modules/libpref/init/all.js index 6adcb30ee2..08817b45f9 100644 --- a/modules/libpref/init/all.js +++ b/modules/libpref/init/all.js @@ -2212,7 +2212,7 @@ pref("security.notification_enable_delay", 500); pref("security.csp.enable", true); pref("security.csp.experimentalEnabled", false); pref("security.csp.enableStrictDynamic", true); -pref("security.csp.reporting.enabled", true); +pref("security.csp.reporting.enabled", false); // Default Content Security Policy to apply to signed contents. pref("security.signed_content.CSP.default", "script-src 'self'; style-src 'self'");