Uploaded image for project: 'FlightPath'
  1. FlightPath
  2. FLPATH-1327

[tracker] enable workflow viewer without requiring unsafe csp policies

XMLWordPrintable

    • False
    • Hide

      None

      Show
      None
    • False

      The workflow editor sources served statically by the orchestrator backend can only run by configuring the following csp for backstage backend:

       script-src: ["'self'", "'unsafe-inline'", "'unsafe-eval'"] 
 script-src-elem: ["'self'", "'unsafe-inline'", "'unsafe-eval'"] 
 connect-src: ["'self'", 'http:', 'https:', 'data:']

      See:
      https://github.com/parodos-dev/orchestrator-helm-chart/blob/main/charts/orchestrator/templates/rhdh-operator.yaml#L86

      This exposed the users to security threats.

              mlibra@redhat.com Marek Libra
              mlibra@redhat.com Marek Libra
              Yona First Yona First
              Votes:
              0 Vote for this issue
              Watchers:
              9 Start watching this issue

                Created:
                Updated:
                Resolved: