Skip to content

Change way default CSP is loaded from config

Lukas Eipert requested to merge leipert-change-csp-logic into master

What does this MR do and why?

When you currently provide a custom CSP config in gitlab.yml, the directives (if set) completely overwrite the default directives. This makes it hard to change one directive. Most meaningful example would be setting report-uri if one only wants CSP to be set in report mode.

A lot of logic is added to the default CSP directives as well, so keeping own settings up to date with the default_directives will be a menial task.

With this change, someone could just change the directives they want. For example in order to disable the default connect-src directive and enabling the report-uri directive, while keeping all the other default directives, one would just simple ste the following:

content_security_policy:
  enabled: true
  report_only: true
  directives:
    connect_src: false
    report_uri: "http://example.org"

Screenshots or screen recordings

These are strongly recommended to assist reviewers and reduce the time to merge your change.

How to set up and validate locally

Numbered steps to set up and validate the change are strongly suggested.

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

Edited by Lukas Eipert

Merge request reports