From a9e73dfe5a4a06276af26cb9ca221b874475a307 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Simonyi=20Gerg=C5=91?= Date: Fri, 8 Nov 2024 17:43:49 +0100 Subject: [PATCH 1/7] add CSP to hardening --- website/docs/security/security-hardening.md | 25 +++++++++++++++++++++ 1 file changed, 25 insertions(+) diff --git a/website/docs/security/security-hardening.md b/website/docs/security/security-hardening.md index 0c6bc18ee8d7..43e23af49e51 100644 --- a/website/docs/security/security-hardening.md +++ b/website/docs/security/security-hardening.md @@ -36,3 +36,28 @@ To prevent any user from creating/editing CAPTCHA stages block API requests to t - `/api/v3/managed/blueprints*` With these restrictions in place, CAPTCHA stages can only be edited using [Blueprints on the file system](../customize/blueprints/index.md#storage---file). + +### Content Security Policy (CSP) + +:::caution +Setting up CSP incorrectly may result in the client not loading necessary third party code. +::: + +Content Security Policy (CSP) is a security standard that mitigates the risk of content injection vulnerabilities. authentik doesn't currently support CSP natively, so setting it up depends on your installation. We recommend using a [reverse proxy](../install-config/reverse-proxy.md) to set a CSP header. + +authentik will require at least the following origins: + +``` +default-src 'self'; +style-src 'self' 'unsafe-inline'; +script-src 'self' 'unsafe-inline'; +img-src 'https:' 'http:' 'data:'; +object-src 'none'; +``` + +Your use case may require more origins on various directives, e.g. + +- when using a CAPTCHA service +- when using Sentry +- when using any custom Javascript in a prompt stage +- when using spotlight sidecar for development From 0b7747034b618808a2ca7972c115d3204fc9aa31 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Simonyi=20Gerg=C5=91?= <28359278+gergosimonyi@users.noreply.github.com> Date: Sat, 9 Nov 2024 20:46:12 +0100 Subject: [PATCH 2/7] re-word docs MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-authored-by: Tana M Berry Signed-off-by: Simonyi Gergő <28359278+gergosimonyi@users.noreply.github.com> --- website/docs/security/security-hardening.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/website/docs/security/security-hardening.md b/website/docs/security/security-hardening.md index 43e23af49e51..1c7262dd4304 100644 --- a/website/docs/security/security-hardening.md +++ b/website/docs/security/security-hardening.md @@ -40,7 +40,7 @@ With these restrictions in place, CAPTCHA stages can only be edited using [Bluep ### Content Security Policy (CSP) :::caution -Setting up CSP incorrectly may result in the client not loading necessary third party code. +Setting up CSP incorrectly may result in the client not loading necessary third-party code. ::: Content Security Policy (CSP) is a security standard that mitigates the risk of content injection vulnerabilities. authentik doesn't currently support CSP natively, so setting it up depends on your installation. We recommend using a [reverse proxy](../install-config/reverse-proxy.md) to set a CSP header. @@ -55,9 +55,9 @@ img-src 'https:' 'http:' 'data:'; object-src 'none'; ``` -Your use case may require more origins on various directives, e.g. +Your use case might require more origins on various directives, e.g. - when using a CAPTCHA service - when using Sentry - when using any custom Javascript in a prompt stage -- when using spotlight sidecar for development +- when using Spotlight Sidecar for development From 6740d97b3f8f60b881d11cf1a521ab9b3c046b3b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Simonyi=20Gerg=C5=91?= Date: Sat, 9 Nov 2024 20:53:47 +0100 Subject: [PATCH 3/7] fix typo --- website/docs/security/security-hardening.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/website/docs/security/security-hardening.md b/website/docs/security/security-hardening.md index 1c7262dd4304..78a8e6e4b2bd 100644 --- a/website/docs/security/security-hardening.md +++ b/website/docs/security/security-hardening.md @@ -59,5 +59,5 @@ Your use case might require more origins on various directives, e.g. - when using a CAPTCHA service - when using Sentry -- when using any custom Javascript in a prompt stage +- when using any custom JavaScript in a prompt stage - when using Spotlight Sidecar for development From 9b71d3f2f480ceabd1374b83c4fa0e838527f6e7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Simonyi=20Gerg=C5=91?= Date: Mon, 11 Nov 2024 15:19:04 +0100 Subject: [PATCH 4/7] use the correct term "location" instead of "origin" in CSP docs --- website/docs/security/security-hardening.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/website/docs/security/security-hardening.md b/website/docs/security/security-hardening.md index 78a8e6e4b2bd..b91394b53863 100644 --- a/website/docs/security/security-hardening.md +++ b/website/docs/security/security-hardening.md @@ -45,7 +45,7 @@ Setting up CSP incorrectly may result in the client not loading necessary third- Content Security Policy (CSP) is a security standard that mitigates the risk of content injection vulnerabilities. authentik doesn't currently support CSP natively, so setting it up depends on your installation. We recommend using a [reverse proxy](../install-config/reverse-proxy.md) to set a CSP header. -authentik will require at least the following origins: +authentik will require at least the following allowed locations: ``` default-src 'self'; @@ -55,7 +55,7 @@ img-src 'https:' 'http:' 'data:'; object-src 'none'; ``` -Your use case might require more origins on various directives, e.g. +Your use case might require more allowed locations for various directives, e.g. - when using a CAPTCHA service - when using Sentry From 388ebcd08fa2a3c1b0d87e735ee6551479b1ce2d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Simonyi=20Gerg=C5=91?= Date: Mon, 11 Nov 2024 15:21:43 +0100 Subject: [PATCH 5/7] reword docs --- website/docs/security/security-hardening.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/website/docs/security/security-hardening.md b/website/docs/security/security-hardening.md index b91394b53863..571856424c1d 100644 --- a/website/docs/security/security-hardening.md +++ b/website/docs/security/security-hardening.md @@ -40,12 +40,12 @@ With these restrictions in place, CAPTCHA stages can only be edited using [Bluep ### Content Security Policy (CSP) :::caution -Setting up CSP incorrectly may result in the client not loading necessary third-party code. +Setting up CSP incorrectly might result in the client not loading necessary third-party code. ::: Content Security Policy (CSP) is a security standard that mitigates the risk of content injection vulnerabilities. authentik doesn't currently support CSP natively, so setting it up depends on your installation. We recommend using a [reverse proxy](../install-config/reverse-proxy.md) to set a CSP header. -authentik will require at least the following allowed locations: +authentik requires at least the following allowed locations: ``` default-src 'self'; From 8c7f95a4859d588316c1639b53e9f3958955897c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Simonyi=20Gerg=C5=91?= Date: Thu, 21 Nov 2024 10:10:58 +0100 Subject: [PATCH 6/7] add comments to permissive CSP directives --- website/docs/security/security-hardening.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/website/docs/security/security-hardening.md b/website/docs/security/security-hardening.md index 315f56eabfca..f2060a03428c 100644 --- a/website/docs/security/security-hardening.md +++ b/website/docs/security/security-hardening.md @@ -60,10 +60,10 @@ authentik requires at least the following allowed locations: ``` default-src 'self'; -style-src 'self' 'unsafe-inline'; -script-src 'self' 'unsafe-inline'; img-src 'https:' 'http:' 'data:'; object-src 'none'; +style-src 'self' 'unsafe-inline'; # Required due to Lit/ShadowDOM +script-src 'self' 'unsafe-inline'; # Required for generated scripts ``` Your use case might require more allowed locations for various directives, e.g. From 8b49c90353c4441215641a0befbcc39ce9515e69 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Simonyi=20Gerg=C5=91?= Date: Thu, 21 Nov 2024 10:23:28 +0100 Subject: [PATCH 7/7] add warning about overwriting existing CSP headers --- website/docs/security/security-hardening.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/website/docs/security/security-hardening.md b/website/docs/security/security-hardening.md index f2060a03428c..6279c4f5636c 100644 --- a/website/docs/security/security-hardening.md +++ b/website/docs/security/security-hardening.md @@ -54,6 +54,10 @@ With these restrictions in place, CAPTCHA stages can only be edited using [Bluep Setting up CSP incorrectly might result in the client not loading necessary third-party code. ::: +:::caution +In some cases, a CSP header will already be set by authentik (for example, in [user uploaded content](https://github.com/goauthentik/authentik/pull/12092/)). Do not overwrite an already existing header as doing so might result in vulnerabilities. Instead, add a new CSP header. +::: + Content Security Policy (CSP) is a security standard that mitigates the risk of content injection vulnerabilities. authentik doesn't currently support CSP natively, so setting it up depends on your installation. We recommend using a [reverse proxy](../install-config/reverse-proxy.md) to set a CSP header. authentik requires at least the following allowed locations: