#1852 Add Observer to remove CSP headers from Adyen requests

[josh-carter]

Description

• Adds observer on core event ``
• Checks action name, if its an Adyen request, remove the CSP headers

Tested scenarios

• Tested all payment flows, currently working in production for a client
• Tested notifications no longer fail when using a large amount of CSP rules

Fixes
#1852

[sonarcloud]

Kudos, SonarCloud Quality Gate passed!   

0 Bugs
0 Vulnerabilities
0 Security Hotspots
0 Code Smells

No Coverage information
0.0% Duplication

[RokPopov]

Hi @josh-carter,

Thank you for this PR and apologies for the late reply.
If I understand this correctly, it seems like the observer is clearing the CSP headers from all the responses where the requests came from Adyen?
Ideally, we would like to limit this functionality only to the webhook responses.

Could I get your thoughts on the above?

Cheers,
Rok

[josh-carter]

Hi @RokPopov

Yep as i mentioned in the issue #1852 I think a better approach would be to make the routes that it removes the CSP headers from configurable via DI, i could update this PR to include a better more maintainable approach asap

[peterojo]

Hi @josh-carter!
Sorry for the long delay, and thanks for your solution.
Would you be able to update your PR to only remove the headers for the webhook endpoint?