Replace CSP 'nonce-<base64>' directive with 'self' directive #43553
Conversation
joshdover
added
Team:Security
|
Pinging @elastic/kibana-security |
|
ACK: reviewing now |
| sourceList = sourceList.filter(source => !source.includes(NONCE_STRING)); | ||
| } | ||
|
|
||
| if (SELF_POLICIES.includes(policy) && !sourceList.find(source => source.includes(SELF_STRING))) { |
There was a problem hiding this comment.
If someone happened to set the following, we'll likely be breaking this install csp.rules: ["default-src 'unsafe-eval' 'nonce-{nonce}'"]. What if instead whenever we removed a nonce source, we added the 'self' source?
There was a problem hiding this comment.
That should work. I think we should still also add it if script-src or style-src don't have self or nonce.
There was a problem hiding this comment.
This seems reasonable to me.
💔 Build Failed |
joshdover
force-pushed
the
csp-nonce-to-self
branch
from
c462845
to
4c1f14a
Compare
💔 Build Failed |
💚 Build Succeeded |
💚 Build Succeeded |
💚 Build Succeeded |
| return h.response(` | ||
| <!DOCTYPE html> | ||
| <title>Kibana OpenID Connect Login</title> | ||
| <script nonce="${nonce}"> | ||
| <script> |
There was a problem hiding this comment.
question: hmmm @joshdover @kobelb aren't we effectively disabling execution of this script here assuming our default CSP rule is script-src 'unsafe-eval' 'self'; now?
There was a problem hiding this comment.
Opened an issue to discuss: #44668
Summary
Closes #42497
This replaces our usage of the
'nonce-{nonce}'directive with'self'which will allow us to support dynamic imports more easily.This change is BWC by adding fixes for any invalid rules in the
csp.rulesconfig option:{nonce}template, that source will be removed and a warning will be logged.'self', it will be added and a warning will be logged.Dev Docs
Kibana no longer supports the
{nonce}notation in thecsp.rulesconfiguration. These will be replaced with the'self'source directive automatically and log a deprecation warning. The{nonce}notation must be removed before upgrading to 8.0.Checklist
Use
strikethroughsto remove checklist items you don't feel are applicable to this PR.For maintainers