Repository navigation
Move CSP options to new platform - #52698
Merged
Merged
Conversation
Contributor
|
Pinging @elastic/kibana-platform (Team:Platform) |
eliperelman
force-pushed
the
feature/np-csp
branch
from
December 10, 2019 21:44
c1b20ce to
02d335a
Compare
pgayvallet
reviewed
Dec 10, 2019
eliperelman
force-pushed
the
feature/np-csp
branch
3 times, most recently
from
December 11, 2019 16:14
002df22 to
255a723
Compare
eliperelman
marked this pull request as ready for review
December 11, 2019 16:21
eliperelman
force-pushed
the
feature/np-csp
branch
from
December 11, 2019 16:33
08c6fb6 to
7ab6d99
Compare
mshustov
reviewed
Dec 11, 2019
joshdover
reviewed
Dec 11, 2019
mshustov
reviewed
Dec 11, 2019
mshustov
reviewed
Dec 12, 2019
eliperelman
force-pushed
the
feature/np-csp
branch
2 times, most recently
from
December 12, 2019 18:49
fe8af81 to
2d3d745
Compare
joshdover
previously requested changes
Dec 12, 2019
joshdover
left a comment
Contributor
There was a problem hiding this comment.
In the last iteration I looked at, directives was not part of the config, which I thought made sense. This revision has it back in the config, which is redundant with the csp.rules config option.
eliperelman
force-pushed
the
feature/np-csp
branch
from
December 13, 2019 11:40
b78c450 to
b81a6f8
Compare
kobelb
self-requested a review
December 13, 2019 15:49
kobelb
reviewed
Dec 13, 2019
| `style-src 'unsafe-inline' 'self'`, | ||
| ], | ||
| }), | ||
| strict: schema.boolean({ defaultValue: true }), |
Contributor
There was a problem hiding this comment.
We'll have to be careful when backporting this, as the default in 7.x is false
joshdover
approved these changes
Dec 13, 2019
joshdover
left a comment
Contributor
There was a problem hiding this comment.
Platform changes LGTM, I'll defer to @elastic/kibana-security for the changes to their plugin.
Contributor
💚 Build SucceededHistory
To update your PR or re-run it, just comment with: |
jportner
approved these changes
Dec 13, 2019
Comment on lines
+28
to
+30
| // TODO: Move this to server.csp using config deprecations | ||
| // ? https://github.com/elastic/kibana/pull/52251 | ||
| path: 'csp', |
Contributor
There was a problem hiding this comment.
Regarding renaming the csp config key, I will handle this in another PR and make sure we reach consensus between the Platform and Security teams =)
Contributor
Author
|
Thanks for all the great reviews! |
eliperelman
added a commit
to eliperelman/kibana
that referenced
this pull request
Dec 16, 2019
* Move CSP options to new platform * Expose SharedGlobalConfig from root * Derive CSP options from config * Consolidate CSP configuration with HTTP config * Fix outstanding config renames * Remove legacy CSP configuration calls, migrate to platform properties * Revise docs * Fix test from type change * Expose ICspConfig, consolidate and simplify CSP defaults access * Rebase and update docs * Remove legacy API from route definition params, review nits * Clean up config path usages for consistency * Regenerate docs
eliperelman
added a commit
that referenced
this pull request
Dec 16, 2019
* Move CSP options to new platform (#52698) * Move CSP options to new platform * Expose SharedGlobalConfig from root * Derive CSP options from config * Consolidate CSP configuration with HTTP config * Fix outstanding config renames * Remove legacy CSP configuration calls, migrate to platform properties * Revise docs * Fix test from type change * Expose ICspConfig, consolidate and simplify CSP defaults access * Rebase and update docs * Remove legacy API from route definition params, review nits * Clean up config path usages for consistency * Regenerate docs * Test correct default value of csp.strict in 7.x
patrykkopycinski
pushed a commit
to patrykkopycinski/kibana
that referenced
this pull request
May 6, 2026
* Move CSP options to new platform * Expose SharedGlobalConfig from root * Derive CSP options from config * Consolidate CSP configuration with HTTP config * Fix outstanding config renames * Remove legacy CSP configuration calls, migrate to platform properties * Revise docs * Fix test from type change * Expose ICspConfig, consolidate and simplify CSP defaults access * Rebase and update docs * Remove legacy API from route definition params, review nits * Clean up config path usages for consistency * Regenerate docs
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
7 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Move CSP options from legacy into the new platform. This blocks being able to add the new rendering service in #52161.
Checklist
Use
strikethroughsto remove checklist items you don't feel are applicable to this PR.Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n supportThis was checked for keyboard-only and screenreader accessibilityFor maintainers
Dev Docs
The default options used for managing Kibana's Content Security Policy have been moved into core for the new platform. Relevant items exposed from
src/core/serverinclude:CspConfig: TypeScript class for generating CSP configuration. Will generate default configuration for any properties not specified in initialization.CspConfig.DEFAULT: Default CSP configuration.ICspConfig: Interface representing CSP configuration.