Merge pull request #5926 from backstage/mob/csp-directive

Remove default upgrade-insecure-requests

.changeset/hip-trees-heal.md

@@ -0,0 +1,23 @@
+---
+'@backstage/backend-common': patch
+---
+
+Omits the `upgrade-insecure-requests` Content-Security-Policy directive by default, to prevent automatic HTTPS request upgrading for HTTP-deployed Backstage sites.
+
+If you previously disabled this using `false` in your `app-config.yaml`, this line is no longer necessary:
+
+```diff
+backend:
+  csp:
+-    upgrade-insecure-requests: false
+```
+
+To keep the existing behavior of `upgrade-insecure-requests` Content-Security-Policy being _enabled_, add the key with an empty array as the value in your `app-config.yaml`:
+
+```diff
+backend:
++  csp:
++    upgrade-insecure-requests: []
+```
+
+Read more on [upgrade-insecure-requests here](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/upgrade-insecure-requests).

app-config.yaml

@@ -37,6 +37,8 @@ backend:
     credentials: true
   csp:
     connect-src: ["'self'", 'http:', 'https:']
+    # Content-Security-Policy directives follow the Helmet format: https://helmetjs.github.io/#reference
+    # Default Helmet Content-Security-Policy values can be removed by setting the key to false
   reading:
     allow:
       - host: example.com

contrib/docs/tutorials/help-im-behind-a-corporate-proxy.md

@@ -80,6 +80,4 @@ backend:
     origin: https://your-public-url.com:3000
 ```
 
-If the protocol is `http`, you will need to set `backend.csp.upgrade-insecure-requests` to `false` as well.
-
 The app port must proxy web socket connections in order to make hot reloading work.

packages/backend-common/src/service/lib/ServiceBuilderImpl.ts

@@ -55,7 +55,6 @@ const DEFAULT_CSP = {
   'script-src': ["'self'", "'unsafe-eval'"],
   'script-src-attr': ["'none'"],
   'style-src': ["'self'", 'https:', "'unsafe-inline'"],
-  'upgrade-insecure-requests': [] as string[],
 };
 
 export class ServiceBuilderImpl implements ServiceBuilder {

packages/create-app/templates/default-app/app-config.yaml.hbs

@@ -11,6 +11,8 @@ backend:
     port: 7000
   csp:
     connect-src: ["'self'", 'http:', 'https:']
+    # Content-Security-Policy directives follow the Helmet format: https://helmetjs.github.io/#reference
+    # Default Helmet Content-Security-Policy values can be removed by setting the key to false
   cors:
     origin: http://localhost:3000
     methods: [GET, POST, PUT, DELETE]