From fb815402ffd8b4d57778abc86a99212b22a95f7b Mon Sep 17 00:00:00 2001 From: Tim Hansen Date: Mon, 7 Jun 2021 10:51:19 -0600 Subject: [PATCH] Changeset language tweaks Signed-off-by: Tim Hansen --- .changeset/hip-trees-heal.md | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/.changeset/hip-trees-heal.md b/.changeset/hip-trees-heal.md index 6c79567187..422402dcee 100644 --- a/.changeset/hip-trees-heal.md +++ b/.changeset/hip-trees-heal.md @@ -2,9 +2,9 @@ '@backstage/backend-common': patch --- -Omit the `upgrade-insecure-requests` Content-Security-Policy directive by default, to prevent automatic HTTPS request upgrading for HTTP-deployed Backstage sites. +Omits the `upgrade-insecure-requests` Content-Security-Policy directive by default, to prevent automatic HTTPS request upgrading for HTTP-deployed Backstage sites. -If you previously disable this using `false` in your `app-config.yaml`, this line is no longer necessary: +If you previously disabled this using `false` in your `app-config.yaml`, this line is no longer necessary: ```diff backend: @@ -12,10 +12,12 @@ backend: - upgrade-insecure-requests: false ``` -But if you want to keep the existing behavior of `upgrade-insecure-requests` Content-Security-Policy being enabled, make the following change in your `app-config.yaml`. You can read more the CSP here https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/upgrade-insecure-requests +To keep the existing behavior of `upgrade-insecure-requests` Content-Security-Policy being _enabled_, add the key with an empty array as the value in your `app-config.yaml`: ```diff backend: + csp: + upgrade-insecure-requests: [] ``` + +Read more on [upgrade-insecure-requests here](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/upgrade-insecure-requests).