PR#4559: Fix and improve the default CSP_HEADERS - pagure

pagure

#4559 Fix and improve the default CSP_HEADERS

Merged 4 years ago by pingou. Opened 4 years ago by pingou.

more_csp_changes into master

Fix and improve the default CSP_HEADERS

Pierre-Yves Chibon • 4 years ago

c163154

pagure/default_config.py

file modified

+3 -2

		`@@ -614,8 +614,9 @@`
		`)`

		`CSP_HEADERS = (`
		`- "default-src 'self' https:; "`
		`+ "default-src 'self';"`
		`"script-src 'self' '{nonce_script}'; "`
		`"style-src 'self' '{nonce_style}'; "`
		`- "object-src" 'none'"`
		`+ "object-src 'none';"`
		`+ "base-uri 'self';"`
		`)`

pingou commented 4 years ago

Signed-off-by: Pierre-Yves Chibon pingou@pingoured.fr

rebased onto c163154

4 years ago

ngompa commented 4 years ago

:thumbsup:

jlanda commented 4 years ago

Does docs work with this? We don't have a frame-src and default does not include https: after this. Embedded docs iframe should fail.

We could add frame-src and connect-src statements when docs and ev are enabled on the config

pingou commented 4 years ago

This is the default and should be tweaked by the admins according to their configuration. Since we do not have neither EV nor docs on by default I think it's fine as is.

However, it may be good to make this explicit in the docs, would you like to open a PR to that end?

jlanda commented 4 years ago

works for me. :thumbsup:

pingou commented 4 years ago

Thanks :)

Pull-Request has been merged by pingou

4 years ago