Summary:
Include support for Content Security Policies
Detailed Description:
If you provide a CSP header of your own, you are very likely going to break page
functionality - but even if you add your own code's hashes and so on (so that
your website/content works), the admin panel generates dynamic/inline CSS and JS
which will not be covered by the CSP you specify and will fail (the Content
Manager, for example, will stop working entirely).
As it currently is - it is impossible to use CMS MS admin without a) using a
unsafe-inline CSP, or b) adding hashes to the CSP each time you begin a new
session with the panel.
I propose that CMS MS generate its own CSP headers, so that it can insert its
own nonces and/or hashes for the dynamically-generated contents it inlines.
It would also be important to have configurability, so that you can add and/or
specify CSP for anything not covered by CMS MS (like your own content's hashes,
frame-ancestors options and so on). This would allow one to move existing CSPs
defined elsewhere into CMS MS.
One potential issue I can see is a situation where a CSP is already applied
externally (via a .htaccess file, for example) and cannot be modified. I know
modifying a CSP is possible, but as I understand - it can only be made more
restrictive in the process. I am unsure as to what solution to propose for this
issue, beyond "move everything to CMS MS and allow it to handle things instead".
Back to List
