doc(csp): add correct csp rule #2548
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Codecov Report
@@ Coverage Diff @@
## master #2548 +/- ##
==========================================
+ Coverage 70.37% 72.02% +1.65%
==========================================
Files 194 61 -133
Lines 7476 3975 -3501
Branches 861 0 -861
==========================================
- Hits 5261 2863 -2398
+ Misses 1923 818 -1105
- Partials 292 294 +2
Flags with carried forward coverage won't be shown. Click here to find out more. Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here. |
SkyeYoung
reviewed
Jul 29, 2022
| @@ -66,8 +66,7 @@ conf: | |||
| # access_control_allow_headers: "Authorization" | |||
| # access_control-allow_methods: "*" | |||
| # x_frame_options: "deny" | |||
| # content_security_policy: ""default-src 'self'; script-src 'self' 'unsafe-eval'; style-src 'self' 'unsafe-inline'"" | |||
|
|
|||
| # content_security_policy: "default-src 'self'; script-src 'self' 'unsafe-eval' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; frame-src xx.xx.xx.xx:3000" # You can set frame-src to provide content for your grafana panel. | |||
There was a problem hiding this comment.
This line of text is too long, and you can't guarantee that everyone's editor is set to auto wrap line.
Suggested change
| # content_security_policy: "default-src 'self'; script-src 'self' 'unsafe-eval' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; frame-src xx.xx.xx.xx:3000" # You can set frame-src to provide content for your grafana panel. | |
| # You can set frame-src to provide content for your grafana panel. | |
| # content_security_policy: "default-src 'self'; script-src 'self' 'unsafe-eval' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; frame-src xx.xx.xx.xx:3000" |
There was a problem hiding this comment.
Not recommended, based on the style of the whole document, I think it would be misleading back to the user if it did.
If you insist, I suggest inviting @bzp2010 to make the final judgment.
There was a problem hiding this comment.
I think it's acceptable for now, and when we merge it to the next branch it will be modified according to the new format. 🤔
ping @SkyeYoung
bzp2010
approved these changes
Aug 3, 2022
| @@ -66,8 +66,7 @@ conf: | |||
| # access_control_allow_headers: "Authorization" | |||
| # access_control-allow_methods: "*" | |||
| # x_frame_options: "deny" | |||
| # content_security_policy: ""default-src 'self'; script-src 'self' 'unsafe-eval'; style-src 'self' 'unsafe-inline'"" | |||
|
|
|||
| # content_security_policy: "default-src 'self'; script-src 'self' 'unsafe-eval' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; frame-src xx.xx.xx.xx:3000" # You can set frame-src to provide content for your grafana panel. | |||
There was a problem hiding this comment.
I think it's acceptable for now, and when we merge it to the next branch it will be modified according to the new format. 🤔
ping @SkyeYoung
SkyeYoung
approved these changes
Aug 3, 2022
Baoyuantop
approved these changes
Aug 3, 2022
guitu168
approved these changes
Aug 3, 2022
hongbinhsu
pushed a commit
to fitphp/apix-dashboard
that referenced
this pull request
Sep 10, 2022
* upstream/master: (23 commits) feat: Add config struct of OpenID-Connect Login (apache#2597) feat: set serverUrlMap with env, update cypress, update stylelint (apache#2583) chore: fix function name typo (apache#2599) fix: page refresh causes deletion exception (apache#2593) feat: support show all enable plugin list tab (apache#2585) fix: drawer components delete plugin not working (apache#2573) feat: add batch delete function for route (apache#2502) test: reduce fe ci time (apache#2557) doc(csp): add correct csp rule (apache#2548) doc: add a notice about the compatibility of Ingress and Dashboard (apache#2552) fix: add judgement for last_report_time (apache#2551) fix: cli test invalid etcd (apache#2544) feat: fix actions version to root version (apache#2521) fix: duplicate ID (apache#2501) fix: block arbitrary file index (apache#2497) docs: update deploy-with-docker.md (apache#2472) feat: translating Turkish for new features (apache#2487) docs: add new import and export docs to sidebar (apache#2485) docs: add data loader and new OpenAPI 3 loader (apache#2484) feat: support data loader in frontend (apache#2480) ... # Conflicts: # api/internal/route.go # web/config/defaultSettings.ts # web/yarn.lock
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR is primarily intended to address the issue of not displaying embedded Grafana dashboards properly.
The issue can be viewed in this issue #2546 .
This issue is caused by the Dashboard updating the CSP (content security policy) feature. You need to add the appropriate configuration for the Grafana dashboard to display properly. This simply adds the configuration options that have been validated and the corresponding documentation.
This PR can also be referenced by the APISIX-Docker project.
Why submit this pull request?
What changes will this PR take into?
Please update this section with detailed description.
fix #2546
Checklist: