TheArchive/zitadel
1
0
Fork 0
mirror of https://github.com/zitadel/zitadel.git synced 2025-02-28 20:47:22 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(console): add posthog to CSP if configured (#9284)

Browse Source 
# Which Problems Are Solved

PostHog scripts are currently blocked by content security policy (CSP).

# How the Problems Are Solved

Add `https://*.i.posthog.com` to the CSP according to
https://posthog.com/docs/advanced/content-security-policy#enabling-the-toolbar
(they suggest  `https://*.posthog.com`)

# Additional Changes

None

# Additional Context

relates to https://github.com/zitadel/zitadel/issues/9076
This commit is contained in:
Livio Spring 2025-02-03 08:08:01 +01:00 committed by GitHub
parent f65db52247
commit 04b9e9b144
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 14 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
internal/api/ui/console/console.go
View File

@ -45,6 +45,8 @@ var (
const ( const (
envRequestPath = "/assets/environment.json" envRequestPath = "/assets/environment.json"
// https://posthog.com/docs/advanced/content-security-policy
posthogCSPHost = "https://*.i.posthog.com"
) )
var ( var (
@ -106,7 +108,7 @@ func Start(config Config, externalSecure bool, issuer op.IssuerFromRequest, call
config.LongCache.MaxAge, config.LongCache.MaxAge,
config.LongCache.SharedMaxAge, config.LongCache.SharedMaxAge,
) )
security := middleware.SecurityHeaders(csp(), nil) security := middleware.SecurityHeaders(csp(config.PostHog.URL), nil)
handler := mux.NewRouter() handler := mux.NewRouter()
@ -145,12 +147,22 @@ func templateInstanceManagementURL(templateableCookieValue string, instance auth
return cookieValue.String(), nil return cookieValue.String(), nil
} }
func csp() *middleware.CSP { func csp(posthogURL string) *middleware.CSP {
csp := middleware.DefaultSCP csp := middleware.DefaultSCP
csp.StyleSrc = csp.StyleSrc.AddInline() csp.StyleSrc = csp.StyleSrc.AddInline()
csp.ScriptSrc = csp.ScriptSrc.AddEval() csp.ScriptSrc = csp.ScriptSrc.AddEval()
csp.ConnectSrc = csp.ConnectSrc.AddOwnHost() csp.ConnectSrc = csp.ConnectSrc.AddOwnHost()
csp.ImgSrc = csp.ImgSrc.AddOwnHost().AddScheme("blob") csp.ImgSrc = csp.ImgSrc.AddOwnHost().AddScheme("blob")
if posthogURL != "" {
// https://posthog.com/docs/advanced/content-security-policy#enabling-the-toolbar
csp.ScriptSrc = csp.ScriptSrc.AddHost(posthogCSPHost)
csp.ConnectSrc = csp.ConnectSrc.AddHost(posthogCSPHost)
csp.ImgSrc = csp.ImgSrc.AddHost(posthogCSPHost)
csp.StyleSrc = csp.StyleSrc.AddHost(posthogCSPHost)
csp.FontSrc = csp.FontSrc.AddHost(posthogCSPHost)
csp.MediaSrc = middleware.CSPSourceOpts().AddHost(posthogCSPHost)
}
return &csp return &csp
} }