From 92963779b56deb6da4954eeff523f316b9dd805f Mon Sep 17 00:00:00 2001 From: Tim Hansen Date: Fri, 4 Jun 2021 10:19:16 -0600 Subject: [PATCH 1/4] Remove default upgrade-insecure-requests Co-authored-by: Mike Lewis Co-authored-by: Himanshu Mishra Signed-off-by: Tim Hansen --- .changeset/hip-trees-heal.md | 13 +++++++++++++ app-config.yaml | 2 ++ .../tutorials/help-im-behind-a-corporate-proxy.md | 2 -- .../src/service/lib/ServiceBuilderImpl.ts | 1 - 4 files changed, 15 insertions(+), 3 deletions(-) create mode 100644 .changeset/hip-trees-heal.md diff --git a/.changeset/hip-trees-heal.md b/.changeset/hip-trees-heal.md new file mode 100644 index 0000000000..2fc9633b98 --- /dev/null +++ b/.changeset/hip-trees-heal.md @@ -0,0 +1,13 @@ +--- +'@backstage/backend-common': patch +--- + +Omit the `upgrade-insecure-requests` Content-Security-Policy directive by default, to prevent automatic HTTPS request upgrading for HTTP-deployed Backstage sites. + +If you previously disable this using `false` in your `app-config.yaml`, this line is no longer necessary: + +```diff +backend: + csp: +- upgrade-insecure-requests: false +``` diff --git a/app-config.yaml b/app-config.yaml index 9874ce37ac..f9dd479e0e 100644 --- a/app-config.yaml +++ b/app-config.yaml @@ -37,6 +37,8 @@ backend: credentials: true csp: connect-src: ["'self'", 'http:', 'https:'] + # Other Content-Security-Policy directives can be added according to the Helmet format: + # https://helmetjs.github.io/#reference reading: allow: - host: example.com diff --git a/contrib/docs/tutorials/help-im-behind-a-corporate-proxy.md b/contrib/docs/tutorials/help-im-behind-a-corporate-proxy.md index bee0a84fe6..841e13dd8b 100644 --- a/contrib/docs/tutorials/help-im-behind-a-corporate-proxy.md +++ b/contrib/docs/tutorials/help-im-behind-a-corporate-proxy.md @@ -80,6 +80,4 @@ backend: origin: https://your-public-url.com:3000 ``` -If the protocol is `http`, you will need to set `backend.csp.upgrade-insecure-requests` to `false` as well. - The app port must proxy web socket connections in order to make hot reloading work. diff --git a/packages/backend-common/src/service/lib/ServiceBuilderImpl.ts b/packages/backend-common/src/service/lib/ServiceBuilderImpl.ts index c17545779a..45eba03157 100644 --- a/packages/backend-common/src/service/lib/ServiceBuilderImpl.ts +++ b/packages/backend-common/src/service/lib/ServiceBuilderImpl.ts @@ -55,7 +55,6 @@ const DEFAULT_CSP = { 'script-src': ["'self'", "'unsafe-eval'"], 'script-src-attr': ["'none'"], 'style-src': ["'self'", 'https:', "'unsafe-inline'"], - 'upgrade-insecure-requests': [] as string[], }; export class ServiceBuilderImpl implements ServiceBuilder { From efef39611341f0a65fc16771a2f174634b82c57a Mon Sep 17 00:00:00 2001 From: Tim Hansen Date: Fri, 4 Jun 2021 20:04:52 -0600 Subject: [PATCH 2/4] Add note about disabling CSP defaults Signed-off-by: Tim Hansen --- app-config.yaml | 4 ++-- packages/create-app/templates/default-app/app-config.yaml.hbs | 2 ++ 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/app-config.yaml b/app-config.yaml index f9dd479e0e..c951594677 100644 --- a/app-config.yaml +++ b/app-config.yaml @@ -37,8 +37,8 @@ backend: credentials: true csp: connect-src: ["'self'", 'http:', 'https:'] - # Other Content-Security-Policy directives can be added according to the Helmet format: - # https://helmetjs.github.io/#reference + # Content-Security-Policy directives follow the Helmet format: https://helmetjs.github.io/#reference + # Default Helmet Content-Security-Policy values can be removed by setting the key to false reading: allow: - host: example.com diff --git a/packages/create-app/templates/default-app/app-config.yaml.hbs b/packages/create-app/templates/default-app/app-config.yaml.hbs index d37cffd680..8c6b2f8f2d 100644 --- a/packages/create-app/templates/default-app/app-config.yaml.hbs +++ b/packages/create-app/templates/default-app/app-config.yaml.hbs @@ -11,6 +11,8 @@ backend: port: 7000 csp: connect-src: ["'self'", 'http:', 'https:'] + # Content-Security-Policy directives follow the Helmet format: https://helmetjs.github.io/#reference + # Default Helmet Content-Security-Policy values can be removed by setting the key to false cors: origin: http://localhost:3000 methods: [GET, POST, PUT, DELETE] From 0c3af8bf848a8a4de9a5adc70247ea2c69b5e7e8 Mon Sep 17 00:00:00 2001 From: Himanshu Mishra Date: Mon, 7 Jun 2021 16:18:06 +0200 Subject: [PATCH 3/4] update changeset to document how to keep the existing behavior Signed-off-by: Himanshu Mishra --- .changeset/hip-trees-heal.md | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/.changeset/hip-trees-heal.md b/.changeset/hip-trees-heal.md index 2fc9633b98..6c79567187 100644 --- a/.changeset/hip-trees-heal.md +++ b/.changeset/hip-trees-heal.md @@ -11,3 +11,11 @@ backend: csp: - upgrade-insecure-requests: false ``` + +But if you want to keep the existing behavior of `upgrade-insecure-requests` Content-Security-Policy being enabled, make the following change in your `app-config.yaml`. You can read more the CSP here https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/upgrade-insecure-requests + +```diff +backend: ++ csp: ++ upgrade-insecure-requests: [] +``` From fb815402ffd8b4d57778abc86a99212b22a95f7b Mon Sep 17 00:00:00 2001 From: Tim Hansen Date: Mon, 7 Jun 2021 10:51:19 -0600 Subject: [PATCH 4/4] Changeset language tweaks Signed-off-by: Tim Hansen --- .changeset/hip-trees-heal.md | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/.changeset/hip-trees-heal.md b/.changeset/hip-trees-heal.md index 6c79567187..422402dcee 100644 --- a/.changeset/hip-trees-heal.md +++ b/.changeset/hip-trees-heal.md @@ -2,9 +2,9 @@ '@backstage/backend-common': patch --- -Omit the `upgrade-insecure-requests` Content-Security-Policy directive by default, to prevent automatic HTTPS request upgrading for HTTP-deployed Backstage sites. +Omits the `upgrade-insecure-requests` Content-Security-Policy directive by default, to prevent automatic HTTPS request upgrading for HTTP-deployed Backstage sites. -If you previously disable this using `false` in your `app-config.yaml`, this line is no longer necessary: +If you previously disabled this using `false` in your `app-config.yaml`, this line is no longer necessary: ```diff backend: @@ -12,10 +12,12 @@ backend: - upgrade-insecure-requests: false ``` -But if you want to keep the existing behavior of `upgrade-insecure-requests` Content-Security-Policy being enabled, make the following change in your `app-config.yaml`. You can read more the CSP here https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/upgrade-insecure-requests +To keep the existing behavior of `upgrade-insecure-requests` Content-Security-Policy being _enabled_, add the key with an empty array as the value in your `app-config.yaml`: ```diff backend: + csp: + upgrade-insecure-requests: [] ``` + +Read more on [upgrade-insecure-requests here](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/upgrade-insecure-requests).