Fix: enrollment overlay in Django 4.0.x

[angela-tran]

Closes #283

Summary

This PR sets SECURE_CROSS_ORIGIN_OPENER_POLICY to same-origin-allow-popups, which is the most secure option that still allows the overlay to work.

This setting was introduced in Django 4.0.x and by default, sets the Cross-Origin-Opener-Policy header to same-origin, which prevents cross-origin popups from accessing their opener's browsing context. Prior to Django 4.0.x, the header was unset.

If you look through the Javascript of our enrollment overlay, you'll notice that it makes use of Window.postMessage() to communicate with the Benefits window and needs to be able to store some variables on that window. So, it makes sense that this header value breaks it, since with it,

the window.opener property of the new window will be null

Other notes

• More explanation on Cross-Origin-Opener-Policy: https://web.dev/why-coop-coep/#coop
• Interesting question on StackOverflow: https://stackoverflow.com/questions/71888175/why-is-a-cross-origin-opener-policy-unsafe-none-header-unsafe
• To more easily read minified Javascript, it helps to enable the experimental Chrome debugger feature Automatically pretty print in Sources Panel: https://stackoverflow.com/a/61816945

[afeld]

Noting that this branch (and dev) is still on Django 3.2, so this setting won't have an effect.

[afeld]

Wow, that's really all the changes that are needed to upgrade to Django 4? Were you able to test the application end to end to verify nothing else in the success path is broken?

[angela-tran]

Wow, that's really all the changes that are needed to upgrade to Django 4? Were you able to test the application end to end to verify nothing else in the success path is broken?

Yep, tested the success path end-to-end.

A lot of the work had already been done in #256 and #268.
When we reverted back down to 3.2.x in #285, we didn't undo those changes.

[thekaveman]

Amazing work on this @angela-tran!! 🔎 🐛 💥

I tested the end-to-end flow locally and it all worked ✅

[afeld]

Shared your discovery: krakenjs/post-robot#84

[machikoyasuda]

Yesssss 👏