-
-
Notifications
You must be signed in to change notification settings - Fork 2.6k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Implement "Content Security Policy" (CSP) #1542
Comments
This is a wontfix. The base restrictions are:
|
Maybe we can re-consider, maybe there would be a technical solution to have Piwik run in this CSP scenario? |
I am not an expert (neither on JavaScript in general nor on CSP in particular) but from what I understand Piwik's JavaScript tracker must not use inline JavaScript and |
@mattab It would be nice if Piwik included CSP in the admin backend for increased security (e.g prevent plugins from executing JS or loading resources from suspicious sources). CSP headers are only sent for documents, not for other page resources, so this won't interfere with calls to the tracking JS at all. A brief overview on CSP can be found at http://content-security-policy.com |
To be clear, this issue is also about not using |
@tsteur Having CSP in our LTS would really help especially some security strict Enterprise environment. Could you please do assessment what it would take not to use |
we can replace it with JSON 3 https://bestiejs.github.io/json3/ I think there's only one other eval in |
Update: in #8896 we removed all uses of We are one step closer to CSP support! 👍 What is our next step for fully supporting CSP? Steps
|
I'm not sure which directives to set for CSP. @robocoder mentioned no inline scripts see #1542 (comment) This can be done but need to document how to do it in FAQ. Which directives should one set to test it properly? |
Keep in mind, that IE 10-11 uses "X-Content-Security-Policy" and Safari < 7 uses "X-Webkit-CSP" in case you want to support those as well. You should consider default-src, script-src, style-src, frame-ancestors; frame-src. See http://www.w3.org/TR/CSP/ To check if everything is working correctly, you can use 'report-uri', to log CSP violations (a good service is https://report-uri.io for setting this up). Current browser support: http://caniuse.com/#feat=contentsecuritypolicy,contentsecuritypolicy2 |
Tested and worked for me. Took me a while to figure out why it didn't work in the beginning until I noticed I was using the Used this in
With old |
@tsteur If you use default-src, you don't need to specify the other *-src if they all use the same value. CSP might have an impact on 3rd party plug-ins, as they may include files from a CDN or other external resources. So this change should be documented clearly. |
I only tested for |
FAQ could be something like this: Is the Piwik JavaScript Tracker CSP (Content Security Policy) compatible and how do I set it up?Yes, Piwik can be used with CSP. However, you cannot use the standard tracking code generated by the Tracking Code Generator in the Piwik UI as it is not allowed to use inline scripts when having CSP enabled. CSP is a security concept to prevent cross-site scripting (XSS) attacks as well as related attacks. Setting up the JavaScript TrackerInstead make sure to put the tracking code into files like this:
The file
Make sure to specify the correct Configuring Content-Secruity-PolicyIf you load An example response header looks like this:
If CSP should work in all browsers you might have to add further headers. At the time of writing this article you might as well need to set |
Thanks, that's a useful and informative FAQ content. Added at: Is the Piwik JavaScript Tracker CSP (Content Security Policy) compatible and how do I set it up? |
This issue has been closed but AFAICT the Matomo admin still doesn't have a CSP. It is a good practice to return a Here is what we used on our server: Content-Security-Policy: default-src 'self'; object-src 'none'; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; img-src 'self' data: Here is what it means:
It's also a good idea to define the following headers: X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
X-Frame-Options: DENY |
Please never use CSP with unsafe-inline or unsafe-eval, it de facto eliminates XSS protection. Instead, generate Example: $nonce = uniqid();
header("Content-Security-Policy: … script-src 'nonce-" . $nonce . "'");
// …
echo '<script nonce="' . $nonce . '">alert("hello world")</script>' |
@Rudloff @fhemberger Thanks for your feedback. But this issue is closed already. Do you mind posting your feedback and questions to this other issue which is still opened: #11720 Thanks! |
Reference:
The proposal would be to add the CSP header, "X-Content-Security-Policy:" with a policy-uri pointing to a static file (which can be cached by the user agent).
Because the specification says the UA must compute the intersection for multiple CSP headers, if a system administrator imposes a more restrictive policy (e.g., via Apache's "append header" directive), it doesn't matter if this feature is enabled by default or not -- a supporting UA will use the more restrictive policy.
Whether or not we implement this feature, CSP, however, will increase the support burden if users complain about why JavaScript may be failing (e.g., not tracking). That is, we have to see the server's response header to diagnose the cause.
The text was updated successfully, but these errors were encountered: