-
Notifications
You must be signed in to change notification settings - Fork 517
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
doc(csp): add correct csp rule #2548
Conversation
Codecov Report
@@ Coverage Diff @@
## master #2548 +/- ##
==========================================
+ Coverage 70.37% 72.02% +1.65%
==========================================
Files 194 61 -133
Lines 7476 3975 -3501
Branches 861 0 -861
==========================================
- Hits 5261 2863 -2398
+ Misses 1923 818 -1105
- Partials 292 294 +2
Flags with carried forward coverage won't be shown. Click here to find out more. Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here. |
@@ -66,8 +66,7 @@ conf: | |||
# access_control_allow_headers: "Authorization" | |||
# access_control-allow_methods: "*" | |||
# x_frame_options: "deny" | |||
# content_security_policy: ""default-src 'self'; script-src 'self' 'unsafe-eval'; style-src 'self' 'unsafe-inline'"" | |||
|
|||
# content_security_policy: "default-src 'self'; script-src 'self' 'unsafe-eval' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; frame-src xx.xx.xx.xx:3000" # You can set frame-src to provide content for your grafana panel. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This line of text is too long, and you can't guarantee that everyone's editor is set to auto wrap line.
# content_security_policy: "default-src 'self'; script-src 'self' 'unsafe-eval' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; frame-src xx.xx.xx.xx:3000" # You can set frame-src to provide content for your grafana panel. | |
# You can set frame-src to provide content for your grafana panel. | |
# content_security_policy: "default-src 'self'; script-src 'self' 'unsafe-eval' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; frame-src xx.xx.xx.xx:3000" |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Not recommended, based on the style of the whole document, I think it would be misleading back to the user if it did.
If you insist, I suggest inviting @bzp2010 to make the final judgment.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I think it's acceptable for now, and when we merge it to the next
branch it will be modified according to the new format. 🤔
ping @SkyeYoung
@@ -66,8 +66,7 @@ conf: | |||
# access_control_allow_headers: "Authorization" | |||
# access_control-allow_methods: "*" | |||
# x_frame_options: "deny" | |||
# content_security_policy: ""default-src 'self'; script-src 'self' 'unsafe-eval'; style-src 'self' 'unsafe-inline'"" | |||
|
|||
# content_security_policy: "default-src 'self'; script-src 'self' 'unsafe-eval' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; frame-src xx.xx.xx.xx:3000" # You can set frame-src to provide content for your grafana panel. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I think it's acceptable for now, and when we merge it to the next
branch it will be modified according to the new format. 🤔
ping @SkyeYoung
* upstream/master: (23 commits) feat: Add config struct of OpenID-Connect Login (apache#2597) feat: set serverUrlMap with env, update cypress, update stylelint (apache#2583) chore: fix function name typo (apache#2599) fix: page refresh causes deletion exception (apache#2593) feat: support show all enable plugin list tab (apache#2585) fix: drawer components delete plugin not working (apache#2573) feat: add batch delete function for route (apache#2502) test: reduce fe ci time (apache#2557) doc(csp): add correct csp rule (apache#2548) doc: add a notice about the compatibility of Ingress and Dashboard (apache#2552) fix: add judgement for last_report_time (apache#2551) fix: cli test invalid etcd (apache#2544) feat: fix actions version to root version (apache#2521) fix: duplicate ID (apache#2501) fix: block arbitrary file index (apache#2497) docs: update deploy-with-docker.md (apache#2472) feat: translating Turkish for new features (apache#2487) docs: add new import and export docs to sidebar (apache#2485) docs: add data loader and new OpenAPI 3 loader (apache#2484) feat: support data loader in frontend (apache#2480) ... # Conflicts: # api/internal/route.go # web/config/defaultSettings.ts # web/yarn.lock
This PR is primarily intended to address the issue of not displaying embedded Grafana dashboards properly.
The issue can be viewed in this issue #2546 .
This issue is caused by the Dashboard updating the CSP (content security policy) feature. You need to add the appropriate configuration for the Grafana dashboard to display properly. This simply adds the configuration options that have been validated and the corresponding documentation.
This PR can also be referenced by the APISIX-Docker project.
Why submit this pull request?
What changes will this PR take into?
Please update this section with detailed description.
fix #2546
Checklist: