Leg 3 project: harden the practice shop

Think of it as a home inspection before you sell a house. The inspector has a checklist. Your job is to tick every box without knocking down any walls the family still needs.

The practice shop

The shop is one Python dict, a shop config, from practice_shop() in watched.leg3b_scorecard. Print it to read it. Its parts:

• "embeds": a list of dicts with "url", "kind" ("script", "font" or "iframe") and "purpose" ("ads", "analytics", "font", "library", "payment" or "video"). A URL starting with / is on the shop's own site. An embed may also have "integrity" and "load": "click".
• "headers": the response headers the shop's pages send.
• "cookies": the shop's Set-Cookie lines.
• "signup": "fields" on the form and "needed", the fields the shop really uses.
• "features_off": browser features the shop never uses.
• "retention_days": kind of data to days kept, where None means forever.

scorecard(shop) builds the shop in the practice world, visits it with a practice browser, and returns a dict with "score" (out of 100), "grade" and the list of "checks". print_scorecard(shop) prints it with advice for every failed check. Anything under "broken" means you removed something the shop needs, and the grade is F however many points you earned.

The checklist (each item is a lesson you have done)

A grade of A needs 90 points or more and nothing broken. The payment script must stay (with SRI), and the video must stay (as click-to-load).

Two notes on the checklist. The CSP check refuses 'unsafe-inline' in script-src even next to a nonce: that is the rule you followed in Lesson 65, and this shop has no very old browsers to support. And Module 10's escaping is not on the scorecard only because a shop config has no templates to check; on a real site it comes first, and CSP is the backup.

Changing a copy, not the original

Your harden(shop) function must not change the dict it is given. Start with shop = copy.deepcopy(shop), which copies the dict and everything inside it, and change the copy.

A common misconception: "the safest site embeds nothing". The scorecard marks that as broken, and rightly: a shop nobody can pay in is not a privacy win, it is a closed shop. Good privacy work keeps the features and removes the watching.

# Django settings.py
SESSION_COOKIE_SECURE = True
SESSION_COOKIE_HTTPONLY = True
SESSION_COOKIE_SAMESITE = "Lax"
SECURE_REFERRER_POLICY = "strict-origin-when-cross-origin"
# Permissions-Policy: a small middleware (lesson 74); CSP: django-csp (module 11)

// JavaScript (Express)
app.use((req, res, next) => {
  res.set("Referrer-Policy", "strict-origin-when-cross-origin");
  res.set("Permissions-Policy", "camera=(), microphone=(), geolocation=()");
  res.set("Content-Security-Policy", "default-src 'self'; frame-ancestors 'none'");
  next();
});
res.cookie("sid", id, { secure: true, httpOnly: true, sameSite: "lax" });

// Go
http.SetCookie(w, &http.Cookie{Name: "sid", Value: id, Path: "/",
    Secure: true, HttpOnly: true, SameSite: http.SameSiteLaxMode})