cloudfront: Support Content-Security-Policy-Report-Only header

[dillonstreator]

Describe the feature

Support setting 'report-only' mode for CSP in the ResponseHeadersPolicy
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy-Report-Only

Use Case

The HTTP Content-Security-Policy-Report-Only response header allows web developers to experiment with policies by monitoring (but not enforcing) their effects. These violation reports consist of JSON documents sent via an HTTP POST request to the specified URI.

Proposed Solution

Add a field ResponseHeadersContentSecurityPolicy.reportOnly as an optional boolean that defaults to false. Internally, this could tack the -Report-Only suffix to the header.

Other Information

No response

Acknowledgements

• I may be able to implement this feature request
• This feature might incur a breaking change

CDK version used

2.126.0

Environment details (OS name and version, etc.)

n/a

[msambol]

I think this can be done with CustomHeadersConfig ?https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-responseheaderspolicy-customheadersconfig.html

[dillonstreator]

@msambol thank you for this callout! This does work and unblocks the use case. I still think the ergonomics/discoverability/DX would be greatly improved if ResponseHeadersContentSecurityPolicy directly supported a reportOnly field to manage this.

[tim-finnigan]

Thanks for the feature request and workaround noted above, linking documentation for reference: https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_cloudfront.ResponseHeadersContentSecurityPolicy.html