website/docs: add CSP to hardening by gergosimonyi · Pull Request #11970 · goauthentik/authentik

gergosimonyi · 2024-11-08T16:45:03Z

No description provided.

netlify · 2024-11-08T16:45:19Z

✅ Deploy Preview for authentik-docs ready!

Name	Link
🔨 Latest commit	`8b49c90`
🔍 Latest deploy log	https://app.netlify.com/sites/authentik-docs/deploys/673efd8485fb430008aa689d
😎 Deploy Preview	https://deploy-preview-11970--authentik-docs.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify site configuration.

netlify · 2024-11-08T16:45:25Z

✅ Deploy Preview for authentik-storybook ready!

Name	Link
🔨 Latest commit	`8b49c90`
🔍 Latest deploy log	https://app.netlify.com/sites/authentik-storybook/deploys/673efd847e6d2c0008b2fd42
😎 Deploy Preview	https://deploy-preview-11970--authentik-storybook.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify site configuration.

codecov · 2024-11-08T16:51:24Z

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 92.67%. Comparing base (4189981) to head (8b49c90).
Report is 5 commits behind head on main.

✅ All tests successful. No failed tests found.

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #11970      +/-   ##
==========================================
- Coverage   92.67%   92.67%   -0.01%     
==========================================
  Files         761      761              
  Lines       37935    37935              
==========================================
- Hits        35158    35156       -2     
- Misses       2777     2779       +2

Flag	Coverage Δ
e2e	`49.20% <ø> (-0.01%)`	⬇️
integration	`24.85% <ø> (ø)`
unit	`90.19% <ø> (ø)`

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚨 Try these New Features:

JS Bundle Analysis - Avoid shipping oversized bundles

github-actions · 2024-11-08T17:36:49Z

authentik PR Installation instructions

Instructions for docker-compose

Add the following block to your .env file:

AUTHENTIK_IMAGE=ghcr.io/goauthentik/dev-server
AUTHENTIK_TAG=gh-8b49c90353c4441215641a0befbcc39ce9515e69
AUTHENTIK_OUTPOSTS__CONTAINER_IMAGE_BASE=ghcr.io/goauthentik/dev-%(type)s:gh-%(build_hash)s

For arm64, use these values:

AUTHENTIK_IMAGE=ghcr.io/goauthentik/dev-server
AUTHENTIK_TAG=gh-8b49c90353c4441215641a0befbcc39ce9515e69-arm64
AUTHENTIK_OUTPOSTS__CONTAINER_IMAGE_BASE=ghcr.io/goauthentik/dev-%(type)s:gh-%(build_hash)s

Afterwards, run the upgrade commands from the latest release notes.

Instructions for Kubernetes

Add the following block to your values.yml file:

authentik:
    outposts:
        container_image_base: ghcr.io/goauthentik/dev-%(type)s:gh-%(build_hash)s
global:
    image:
        repository: ghcr.io/goauthentik/dev-server
        tag: gh-8b49c90353c4441215641a0befbcc39ce9515e69

For arm64, use these values:

authentik:
    outposts:
        container_image_base: ghcr.io/goauthentik/dev-%(type)s:gh-%(build_hash)s
global:
    image:
        repository: ghcr.io/goauthentik/dev-server
        tag: gh-8b49c90353c4441215641a0befbcc39ce9515e69-arm64

Afterwards, run the upgrade commands from the latest release notes.

website/docs/security/security-hardening.md

tanberry

A few editing thangs.

website/docs/security/security-hardening.md

Co-authored-by: Tana M Berry <tanamarieberry@yahoo.com> Signed-off-by: Simonyi Gergő <28359278+gergosimonyi@users.noreply.github.com>

tanberry · 2024-11-11T13:49:18Z

website/docs/security/security-hardening.md

+### Content Security Policy (CSP)
+
+:::caution
+Setting up CSP incorrectly may result in the client not loading necessary third-party code.


Suggested change

Setting up CSP incorrectly may result in the client not loading necessary third-party code.

Setting up CSP incorrectly might result in the client not loading necessary third-party code.

tanberry · 2024-11-11T13:49:45Z

website/docs/security/security-hardening.md

+
+Content Security Policy (CSP) is a security standard that mitigates the risk of content injection vulnerabilities. authentik doesn't currently support CSP natively, so setting it up depends on your installation. We recommend using a [reverse proxy](../install-config/reverse-proxy.md) to set a CSP header.
+
+authentik will require at least the following origins:


Suggested change

authentik will require at least the following origins:

authentik requires at least the following origins:

Should we explain more about what an origin is? Where to define it? Do we have any links about it to link to?

Offline resolution: we should use the word used by the CSP spec: "location"

tanberry

I thought I had edited that use of "may" before, but maybe I missed this one. (We want to use "might", to imply chances, instead of "may" which implies permission. :-)

BeryJu · 2024-11-20T17:36:18Z

/cherry-pick version-2024.10

rissson · 2024-11-20T17:40:49Z

website/docs/security/security-hardening.md

+:::
+
+Content Security Policy (CSP) is a security standard that mitigates the risk of content injection vulnerabilities. authentik doesn't currently support CSP natively, so setting it up depends on your installation. We recommend using a [reverse proxy](../install-config/reverse-proxy.md) to set a CSP header.
+


We probably should cross-reference #12092 so that that behaviour is also documented. People deploying a custom csp might overlook this and override those headers.

Added a general warning not to overwrite any existing CSP header.

BeryJu · 2024-11-20T17:42:26Z

website/docs/security/security-hardening.md

+
+```
+default-src 'self';
+style-src 'self' 'unsafe-inline';


We might want to add comments that explain why we need unsafe-inline for styles and scripts based on the comments I had in the notes in notion

Fair enough, added.

(A bit weird syntactically because this is a language-agnostic text block, but anyone who's implementing it will understand.)

* add CSP to hardening * re-word docs Co-authored-by: Tana M Berry <tanamarieberry@yahoo.com> Signed-off-by: Simonyi Gergő <28359278+gergosimonyi@users.noreply.github.com> * fix typo * use the correct term "location" instead of "origin" in CSP docs * reword docs * add comments to permissive CSP directives * add warning about overwriting existing CSP headers --------- Signed-off-by: Simonyi Gergő <28359278+gergosimonyi@users.noreply.github.com> Co-authored-by: Tana M Berry <tanamarieberry@yahoo.com>

website/docs: add CSP to hardening (#11970) * add CSP to hardening * re-word docs * fix typo * use the correct term "location" instead of "origin" in CSP docs * reword docs * add comments to permissive CSP directives * add warning about overwriting existing CSP headers --------- Signed-off-by: Simonyi Gergő <28359278+gergosimonyi@users.noreply.github.com> Co-authored-by: Simonyi Gergő <28359278+gergosimonyi@users.noreply.github.com> Co-authored-by: Tana M Berry <tanamarieberry@yahoo.com>

* main: (23 commits) website/docs: update info about footer links to match new UI (#12120) website/docs: prepare release notes (#12142) providers/oauth2: fix migration (#12138) providers/oauth2: fix migration dependencies (#12123) web: bump API Client version (#12129) providers/oauth2: fix redirect uri input (#12122) providers/proxy: fix redirect_uri (#12121) website/docs: prepare release notes (#12119) web: bump API Client version (#12118) security: fix CVE 2024 52289 (#12113) security: fix CVE 2024 52307 (#12115) security: fix CVE 2024 52287 (#12114) website/docs: add CSP to hardening (#11970) core: bump uvicorn from 0.32.0 to 0.32.1 (#12103) core: bump google-api-python-client from 2.153.0 to 2.154.0 (#12104) core: bump pydantic from 2.9.2 to 2.10.0 (#12105) translate: Updates for file locale/en/LC_MESSAGES/django.po in it (#12110) internal: add CSP header to files in `/media` (#12092) core, web: update translations (#12101) web: fix bug that prevented error reporting in current wizard. (#12033) ...

add CSP to hardening

a9e73df

gergosimonyi requested a review from a team November 8, 2024 16:45

gergosimonyi requested a review from a team as a code owner November 8, 2024 16:45

gergosimonyi requested review from BeryJu and fheisler November 8, 2024 16:45

fheisler reviewed Nov 8, 2024

View reviewed changes

website/docs/security/security-hardening.md Outdated Show resolved Hide resolved

tanberry requested changes Nov 8, 2024

View reviewed changes

website/docs/security/security-hardening.md Outdated Show resolved Hide resolved

website/docs/security/security-hardening.md Outdated Show resolved Hide resolved

website/docs/security/security-hardening.md Outdated Show resolved Hide resolved

gergosimonyi and others added 2 commits November 9, 2024 20:46

re-word docs

0b77470

Co-authored-by: Tana M Berry <tanamarieberry@yahoo.com> Signed-off-by: Simonyi Gergő <28359278+gergosimonyi@users.noreply.github.com>

fix typo

6740d97

gergosimonyi requested review from fheisler and tanberry November 9, 2024 19:54

tanberry reviewed Nov 11, 2024

View reviewed changes

tanberry requested changes Nov 11, 2024

View reviewed changes

gergosimonyi added 2 commits November 11, 2024 15:19

use the correct term "location" instead of "origin" in CSP docs

9b71d3f

reword docs

388ebcd

tanberry approved these changes Nov 11, 2024

View reviewed changes

Merge branch 'main' into website/docs/add-CSP-to-hardening

b83942c

rissson reviewed Nov 20, 2024

View reviewed changes

BeryJu reviewed Nov 20, 2024

View reviewed changes

gergosimonyi added 3 commits November 21, 2024 10:03

Merge branch 'main' into website/docs/add-CSP-to-hardening

3645f41

add comments to permissive CSP directives

8c7f95a

add warning about overwriting existing CSP headers

8b49c90

BeryJu approved these changes Nov 21, 2024

View reviewed changes

gergosimonyi merged commit a9b3a4c into main Nov 21, 2024

gergosimonyi deleted the website/docs/add-CSP-to-hardening branch November 21, 2024 13:20

gcp-cherry-pick-bot bot mentioned this pull request Nov 21, 2024

website/docs: add CSP to hardening (cherry-pick #11970) #12116

Merged

	Setting up CSP incorrectly may result in the client not loading necessary third-party code.
	Setting up CSP incorrectly might result in the client not loading necessary third-party code.


		Content Security Policy (CSP) is a security standard that mitigates the risk of content injection vulnerabilities. authentik doesn't currently support CSP natively, so setting it up depends on your installation. We recommend using a [reverse proxy](../install-config/reverse-proxy.md) to set a CSP header.

		authentik will require at least the following origins:

	authentik will require at least the following origins:
	authentik requires at least the following origins:

Uh oh!

Conversation

gergosimonyi commented Nov 8, 2024

Uh oh!

netlify bot commented Nov 8, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for authentik-docs ready!

Uh oh!

netlify bot commented Nov 8, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for authentik-storybook ready!

Uh oh!

codecov bot commented Nov 8, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

github-actions bot commented Nov 8, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

tanberry left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

tanberry left a comment

Choose a reason for hiding this comment

Uh oh!

BeryJu commented Nov 20, 2024

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

netlify bot commented Nov 8, 2024 •

edited

Loading

netlify bot commented Nov 8, 2024 •

edited

Loading

codecov bot commented Nov 8, 2024 •

edited

Loading

github-actions bot commented Nov 8, 2024 •

edited

Loading