As of Play 2.6, Play applications' HTTP responses include a "Content-Security-Policy" header that prevents JavaScript embedded on a webpage from running. This was problematic for the PlayFOP sample applications, as they rely on such JavaScript. So, via an application.conf change in commit 16d7928 (play.filters.headers.contentSecurityPolicy = null), that header was disabled.
Determine whether that header provides actual security benefits for the PlayFOP sample applications. If it does, re-work their JavaScript and re-enable it.
As of Play 2.6, Play applications' HTTP responses include a "Content-Security-Policy" header that prevents JavaScript embedded on a webpage from running. This was problematic for the PlayFOP sample applications, as they rely on such JavaScript. So, via an
application.confchange in commit 16d7928 (play.filters.headers.contentSecurityPolicy = null), that header was disabled.Determine whether that header provides actual security benefits for the PlayFOP sample applications. If it does, re-work their JavaScript and re-enable it.