Implement CSPs on data.gov, catalog.data.gov, resources.data.gov

[tdlowden]

User Story

In order to take all measures to prevent XSS attacks, datagovteam wants to implement a Content Security Policy.

Acceptance Criteria

• GIVEN XSS attacks are possible
  AND having CSPs is an accepted web best practice
  WHEN a page loads
  THEN a CSP is present in the header

Background

18F recommends CSPs https://guides.18f.gov/engineering/security/content-security-policy/

AND we get a ding on ScanGov score for not having one on data.gov specifically: https://scangov.org/profile/?domain=data.gov#security

Despite data.gov and resources.data.gov being static sites, it would help us maintain better "scores" to have a CSP in place.

Security Considerations (required)

Will improve security posture from data injection and XSS attacks

Sketch

• Add CSP on data.gov via meta-tag
• Add CSP on catalog.data.gov via meta-tag
• Add CSP on resources.data.gov via meta-tag