fix(security): relax CSP for Swagger UI via per-path quarkus.http.filter - #518
Conversation
Swagger UI was blocked by the global Content-Security-Policy header (script-src 'self'). Replaced the global quarkus.http.header.Content-Security-Policy with two quarkus.http.filter entries: a strict default (order=10) for the entire app, and a relaxed override (order=20) for /q/swagger-ui/* that adds 'unsafe-inline' + 'unsafe-eval' to script-src.
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.Scanned FilesNone |
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughContent-Security-Policy is refactored from a single global header to two Quarkus HTTP filters with path matching: a strict default for all routes and a higher-precedence relaxed policy for Swagger UI that permits inline and eval scripts. The change is recorded in the changelog. ChangesCSP Configuration Fix
sequenceDiagram
participant Client
participant QuarkusFilterChain
participant CspSwaggerFilter
participant CspDefaultFilter
participant ServerResponse
Client->>QuarkusFilterChain: HTTP request (/q/swagger-ui/* or other)
QuarkusFilterChain->>CspSwaggerFilter: path match check (/q/swagger-ui(/.*)?)
alt matches
CspSwaggerFilter->>ServerResponse: apply relaxed CSP (unsafe-inline, unsafe-eval)
else does not match
QuarkusFilterChain->>CspDefaultFilter: apply strict CSP
CspDefaultFilter->>ServerResponse: apply strict CSP
end
ServerResponse-->>Client: response with selected CSP header
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (1)
src/main/resources/application.properties (1)
152-152: ⚡ Quick winWiden CSP-match to cover
/q/swagger-uiwithout trailing slash (edge cases)
quarkus.http.filter.csp-swagger.matches=/q/swagger-ui/.*only matches requests to/q/swagger-ui/…; in typical Quarkus behavior/q/swagger-uiis redirected to/q/swagger-ui/, so Swagger UI assets still get the relaxed CSP, but reverse-proxy/URL-normalization edge cases can bypass that redirect—consider updating the match to/q/swagger-ui(/.*)?to be safe.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/main/resources/application.properties` at line 152, The CSP match property quarkus.http.filter.csp-swagger.matches currently only matches paths with a trailing slash; update its regex to cover both /q/swagger-ui and /q/swagger-ui/... (e.g. change to a pattern like /q/swagger-ui(/.*)? ) so the CSP rule applies whether the trailing slash is present or not; modify the value of quarkus.http.filter.csp-swagger.matches accordingly.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@src/main/resources/application.properties`:
- Line 152: The CSP match property quarkus.http.filter.csp-swagger.matches
currently only matches paths with a trailing slash; update its regex to cover
both /q/swagger-ui and /q/swagger-ui/... (e.g. change to a pattern like
/q/swagger-ui(/.*)? ) so the CSP rule applies whether the trailing slash is
present or not; modify the value of quarkus.http.filter.csp-swagger.matches
accordingly.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 195326d5-deb4-4666-a1fe-3fa0692a0af6
📒 Files selected for processing (2)
docs/changelog.mdsrc/main/resources/application.properties
…ng slash Changed regex from /q/swagger-ui/.* to /q/swagger-ui(/.*)? to cover reverse-proxy edge cases where the redirect to /q/swagger-ui/ is bypassed.
There was a problem hiding this comment.
Pull request overview
This PR fixes Swagger UI rendering being blocked by an overly strict global Content Security Policy (CSP) by moving CSP configuration to path-based Quarkus HTTP filters, keeping a strict CSP for most endpoints while relaxing script-src specifically for Swagger UI.
Changes:
- Replaced global
quarkus.http.header.Content-Security-Policywith twoquarkus.http.filter-based CSP header configurations (default + Swagger override). - Added changelog documentation explaining the root cause and why the filter-based approach was chosen.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| src/main/resources/application.properties | Switches CSP from global header to per-path Quarkus HTTP filters (strict default + relaxed Swagger UI policy). |
| docs/changelog.md | Documents the CSP/Swagger UI breakage root cause and the filter-based override rationale. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| font-src 'self'; frame-ancestors 'none'; | ||
| # Swagger UI: relaxed CSP (order=20, higher priority — overrides default) | ||
| # Swagger UI requires 'unsafe-inline' + 'unsafe-eval' for inline scripts and JSON schema rendering. | ||
| quarkus.http.filter.csp-swagger.matches=/q/swagger-ui(/.*)? |
| ### Fix | ||
| Replaced the global `quarkus.http.header.Content-Security-Policy` with two `quarkus.http.filter` entries using Quarkus's native path-based filter mechanism: | ||
| - **`csp-default`** (order=10, matches `/.*`): Strict CSP for the entire application — `script-src 'self'` | ||
| - **`csp-swagger`** (order=20, matches `/q/swagger-ui/.*`): Relaxed CSP — adds `'unsafe-inline' 'unsafe-eval'` to `script-src` |
This pull request addresses a bug where the Swagger UI was broken due to an overly strict Content Security Policy (CSP) applied globally. The solution introduces path-based CSP overrides using Quarkus's native filter mechanism, ensuring strong security for the rest of the application while allowing Swagger UI to function properly. The change also documents the root cause and rationale for the chosen approach.
Security header configuration:
quarkus.http.header.Content-Security-Policywith two path-basedquarkus.http.filterentries inapplication.properties: a strict default CSP for all paths and a relaxed CSP for/q/swagger-ui/.*that adds'unsafe-inline'and'unsafe-eval'toscript-srcfor Swagger UI compatibility.Summary by CodeRabbit