Project

General

Profile

Actions

Bug #24062

closed

Implementing CSP headers without duplicating Lift scripts

Added by Clark ANDRIANASOLO 4 months ago. Updated about 2 months ago.

Status:
Released
Priority:
N/A
Category:
Security
Target version:
Severity:
Minor - inconvenience | misleading | easy workaround
UX impact:
User visibility:
Effort required:
Small
Priority:
0
Name check:
To do
Fix check:
To do
Regression:
No

Description

When we implemented CSP headers we found out that the Lift web framework appends scripts to the HTML response, and there is no convenient way to hook into the scripts and add nonce attributes to them. So we allowed duplicate scripts, one we added with a nonce and another one added by Lift, causing a CSP violation in the browser (healthcheck page only).

We should find a way to avoid the duplication.

Also we should fix all current violations on the healthcheck page :


Files

clipboard-202401231748-btx8j.png (16.3 KB) clipboard-202401231748-btx8j.png Clark ANDRIANASOLO, 2024-01-23 17:48
clipboard-202401231748-8wohf.png (16.3 KB) clipboard-202401231748-8wohf.png Clark ANDRIANASOLO, 2024-01-23 17:48

Related issues 2 (0 open2 closed)

Related to Rudder - Bug #24016: Implement CSP strict headers with nonce and apply to healtcheck pageReleasedFrançois ARMANDActions
Related to Rudder - Bug #24041: Fix default font size and menu toggleReleasedVincent MEMBRÉActions
Actions

Also available in: Atom PDF