paulononato/backstage
1
0
Fork 0
Code Issues Pull Requests Actions 38 Packages Projects Releases Wiki Activity

Changeset language tweaks

Browse Source 
Signed-off-by: Tim Hansen <timbonicus@gmail.com>
This commit is contained in:
Tim Hansen
2021-06-07 10:51:19 -06:00
parent 0c3af8bf84
commit fb815402ff
1 changed files with 5 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.changeset/hip-trees-heal.md
+5 -3
View File
@@ -2,9 +2,9 @@
'@backstage/backend-common': patch
---
Omit the `upgrade-insecure-requests` Content-Security-Policy directive by default, to prevent automatic HTTPS request upgrading for HTTP-deployed Backstage sites.
Omits the `upgrade-insecure-requests` Content-Security-Policy directive by default, to prevent automatic HTTPS request upgrading for HTTP-deployed Backstage sites.
If you previously disable this using `false` in your `app-config.yaml`, this line is no longer necessary:
If you previously disabled this using `false` in your `app-config.yaml`, this line is no longer necessary:
```diff
backend:
@@ -12,10 +12,12 @@ backend:
- upgrade-insecure-requests: false
```
But if you want to keep the existing behavior of `upgrade-insecure-requests` Content-Security-Policy being enabled, make the following change in your `app-config.yaml`. You can read more the CSP here https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/upgrade-insecure-requests
To keep the existing behavior of `upgrade-insecure-requests` Content-Security-Policy being _enabled_, add the key with an empty array as the value in your `app-config.yaml`:
```diff
backend:
+ csp:
+ upgrade-insecure-requests: []
```
Read more on [upgrade-insecure-requests here](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/upgrade-insecure-requests).