tsai
/
thingsboard
mirror of https://github.com/thingsboard/thingsboard.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity
Browse Source

Update default CSP value covering core ThingsBoard functionality

pull/15266/head
Viacheslav Klimov 6 months ago
parent
628fe04032
commit
02529029c5
Failed to extract signature
1 changed files with 6 additions and 3 deletions
Whitespace
Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL
Unified View
Diff Options
Show Stats Download Patch File Download Diff File
  1. 9
      application/src/main/resources/thingsboard.yml

9
application/src/main/resources/thingsboard.yml
View File

@ -215,12 +215,15 @@ security:
# - Widgets loading external resources (images, fonts, scripts) # - Widgets loading external resources (images, fonts, scripts)
# - Dashboard embedding via iframes (if frame-ancestors is restrictive) # - Dashboard embedding via iframes (if frame-ancestors is restrictive)
# Use 'report-only: true' first to test the impact before enforcing. # Use 'report-only: true' first to test the impact before enforcing.
# Example value: "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self'; frame-ancestors 'self'" # The default value covers core ThingsBoard functionality including OpenStreetMap, ArcGIS maps,
# solution template previews, WebSocket telemetry, and chart Web Workers.
# NOTE: Google Maps requires adding Google domains to script-src, which is not included by default.
# To add Google Maps support, append to script-src: https://maps.googleapis.com https://maps.gstatic.com
content-security-policy: content-security-policy:
# Enable/disable Content-Security-Policy header. Mitigates XSS and data injection attacks # Enable/disable Content-Security-Policy header. Mitigates XSS and data injection attacks
enabled: "${SECURITY_HEADERS_CONTENT_SECURITY_POLICY_ENABLED:false}" enabled: "${SECURITY_HEADERS_CONTENT_SECURITY_POLICY_ENABLED:false}"
# Full CSP directive string # Full CSP directive string. The default value is a working policy for most ThingsBoard deployments
value: "${SECURITY_HEADERS_CONTENT_SECURITY_POLICY_VALUE:}" value: "${SECURITY_HEADERS_CONTENT_SECURITY_POLICY_VALUE:default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https://img.thingsboard.io https://tile.openstreetmap.org https://*.tile.openstreetmap.org https://*.arcgis.com; font-src 'self' data:; connect-src 'self' ws: wss: https://*.arcgis.com https://*.arcgisonline.com; worker-src 'self' blob:; frame-ancestors 'self'}"
# If true, uses Content-Security-Policy-Report-Only header instead — the browser # If true, uses Content-Security-Policy-Report-Only header instead — the browser
# reports violations but does not enforce them. Use for testing before enforcing. # reports violations but does not enforce them. Use for testing before enforcing.
report-only: "${SECURITY_HEADERS_CONTENT_SECURITY_POLICY_REPORT_ONLY:false}" report-only: "${SECURITY_HEADERS_CONTENT_SECURITY_POLICY_REPORT_ONLY:false}"

Write Preview
Loading…
Cancel
Save