From 052390d52713e36f3e08752c2a42816fff6554e1 Mon Sep 17 00:00:00 2001 From: shyamajp <70650120+shyamajp@users.noreply.github.com> Date: Fri, 25 Feb 2022 13:58:04 +0200 Subject: [PATCH 1/2] Update GA module instructions with CSP Add instruction to load scripts from GA by modifying csp to a minimal level Signed-off-by: Shiori Yamazaki --- plugins/analytics-module-ga/README.md | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/plugins/analytics-module-ga/README.md b/plugins/analytics-module-ga/README.md index 92cfd7e9ae..a11243204d 100644 --- a/plugins/analytics-module-ga/README.md +++ b/plugins/analytics-module-ga/README.md @@ -47,6 +47,19 @@ app: trackingId: UA-0000000-0 ``` +4. Update CSP in your `app-config.yaml`: + +The following is the minimul content security policy required to load scripts from GA. + +```yaml +backend: + csp: + connect-src: ["'self'", 'http:', 'https:'] + # Add these two lines below + script-src: ["'self'", "'unsafe-eval'", 'https://www.google-analytics.com'] + img-src: ["'self'", 'data:', 'https://www.google-analytics.com'] +``` + ## Configuration In order to be able to analyze usage of your Backstage instance _by plugin_, we From 123019673b9d2b36b3e0e19d3b413037da217def Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fredrik=20Adel=C3=B6w?= Date: Fri, 25 Feb 2022 14:59:23 +0100 Subject: [PATCH 2/2] fixup MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Fredrik Adelöw --- .changeset/eight-adults-joke.md | 5 +++++ plugins/analytics-module-ga/README.md | 2 +- 2 files changed, 6 insertions(+), 1 deletion(-) create mode 100644 .changeset/eight-adults-joke.md diff --git a/.changeset/eight-adults-joke.md b/.changeset/eight-adults-joke.md new file mode 100644 index 0000000000..ffda738213 --- /dev/null +++ b/.changeset/eight-adults-joke.md @@ -0,0 +1,5 @@ +--- +'@backstage/plugin-analytics-module-ga': patch +--- + +Added CSP instructions to README diff --git a/plugins/analytics-module-ga/README.md b/plugins/analytics-module-ga/README.md index a11243204d..4b822ea3e3 100644 --- a/plugins/analytics-module-ga/README.md +++ b/plugins/analytics-module-ga/README.md @@ -49,7 +49,7 @@ app: 4. Update CSP in your `app-config.yaml`: -The following is the minimul content security policy required to load scripts from GA. +The following is the minimal content security policy required to load scripts from GA. ```yaml backend: