You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The current Content Security Policy is hardcoded, but not all deployments have the same requirements. It would be helpful to allow customizing the CSP, for example, from an ini file.
Hi, and what are those requirements? If we talk about ini configuration, this is important to me since it might answer the question whether only some features can be toggled or if the full policy should be possible to override.
I'd rather want to avoid that we open up the override of the policy without verifying that some of the parts are a candidate to include in the default.
Many of those are just simple flags, and the only variables are the nonce and the root url, both of which Icinga Web knows very well. Because of this, many of the parts might be a candidate.
So if you know what you want, you should be able to tell me what could be in the default policy. Though, if it's about unsafe-* I'm afraid that's not an option ;) (Just mentioning this because that's what the grafana docs mention)
Yes, you're right, some of these candidates can be included in the default (for example base-uri 'none' etc).
But what I'm thinking is, for example, if I wanted to add a default-src 'self' or 'none' I would then have to add a whitelist for the things I need (ideally img-src domain.com data:// etc.) or for example, If I use some CDN I have to add CDN domain to script-src.
Activity
nilmerg commentedon Mar 7, 2025
Hi, and what are those requirements? If we talk about ini configuration, this is important to me since it might answer the question whether only some features can be toggled or if the full policy should be possible to override.
Alemmi commentedon Mar 17, 2025
My idea is similar to what grafana did with the CSP
https://grafana.com/docs/grafana/latest/setup-grafana/configure-security/configure-security-hardening/#add-a-content-security-policy
nilmerg commentedon Mar 17, 2025
I'd rather want to avoid that we open up the override of the policy without verifying that some of the parts are a candidate to include in the default.
Many of those are just simple flags, and the only variables are the nonce and the root url, both of which Icinga Web knows very well. Because of this, many of the parts might be a candidate.
So if you know what you want, you should be able to tell me what could be in the default policy. Though, if it's about
unsafe-*I'm afraid that's not an option ;) (Just mentioning this because that's what the grafana docs mention)Alemmi commentedon Mar 17, 2025
Yes, you're right, some of these candidates can be included in the default (for example
base-uri 'none'etc).But what I'm thinking is, for example, if I wanted to add a
default-src 'self'or'none'I would then have to add a whitelist for the things I need (ideally img-src domain.com data:// etc.) or for example, If I use some CDN I have to add CDN domain toscript-src.nilmerg commentedon Mar 17, 2025
If you use a CDN, it sounds like a very isolated occurrence. Can't you just patch the header using the web server?
nilmerg commentedon May 14, 2025
Please see my latest comment in the linked PR