Skip to content

website/docs: add CSP to hardening #11970

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
gergosimonyi merged 9 commits into from
Nov 21, 2024
Merged

website/docs: add CSP to hardening #11970

Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
a9e73df
add CSP to hardening
gergosimonyi Nov 8, 2024
0b77470
re-word docs
gergosimonyi Nov 9, 2024
6740d97
fix typo
gergosimonyi Nov 9, 2024
9b71d3f
use the correct term "location" instead of "origin" in CSP docs
gergosimonyi Nov 11, 2024
388ebcd
reword docs
gergosimonyi Nov 11, 2024
b83942c
Merge branch 'main' into website/docs/add-CSP-to-hardening
gergosimonyi Nov 19, 2024
3645f41
Merge branch 'main' into website/docs/add-CSP-to-hardening
gergosimonyi Nov 21, 2024
8c7f95a
add comments to permissive CSP directives
gergosimonyi Nov 21, 2024
8b49c90
add warning about overwriting existing CSP headers
gergosimonyi Nov 21, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
29 changes: 29 additions & 0 deletions website/docs/security/security-hardening.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,3 +47,32 @@ To prevent any user from creating/editing CAPTCHA stages block API requests to t
- `/api/v3/managed/blueprints*`

With these restrictions in place, CAPTCHA stages can only be edited using [Blueprints on the file system](../customize/blueprints/index.md#storage---file).

### Content Security Policy (CSP)

:::caution
Setting up CSP incorrectly might result in the client not loading necessary third-party code.
:::

:::caution
In some cases, a CSP header will already be set by authentik (for example, in [user uploaded content](https://github.com/goauthentik/authentik/pull/12092/)). Do not overwrite an already existing header as doing so might result in vulnerabilities. Instead, add a new CSP header.
:::

Content Security Policy (CSP) is a security standard that mitigates the risk of content injection vulnerabilities. authentik doesn't currently support CSP natively, so setting it up depends on your installation. We recommend using a [reverse proxy](../install-config/reverse-proxy.md) to set a CSP header.

@rissson rissson Nov 20, 2024

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We probably should cross-reference #12092 so that that behaviour is also documented. People deploying a custom csp might overlook this and override those headers.

@gergosimonyi gergosimonyi Nov 21, 2024

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Added a general warning not to overwrite any existing CSP header.

authentik requires at least the following allowed locations:

```
default-src 'self';
img-src 'https:' 'http:' 'data:';
object-src 'none';
style-src 'self' 'unsafe-inline'; # Required due to Lit/ShadowDOM
script-src 'self' 'unsafe-inline'; # Required for generated scripts
```

Your use case might require more allowed locations for various directives, e.g.

- when using a CAPTCHA service
- when using Sentry
- when using any custom JavaScript in a prompt stage
- when using Spotlight Sidecar for development