Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

website/docs: add CSP to hardening #11970

Open
wants to merge 5 commits into
base: main
Choose a base branch
from
Open

website/docs: add CSP to hardening #11970

wants to merge 5 commits into from
+25 −0

Conversation

gergosimonyi
Copy link
Collaborator

No description provided.

@gergosimonyi gergosimonyi requested a review from a team November 8, 2024 16:45
@gergosimonyi gergosimonyi requested a review from a team as a code owner November 8, 2024 16:45
@netlify Netlify
Copy link

netlify bot commented Nov 8, 2024 •
edited
Loading

✅ Deploy Preview for authentik-docs ready!

Name Link
🔨 Latest commit 388ebcd
🔍 Latest deploy log https://app.netlify.com/sites/authentik-docs/deploys/6732131ce6b71a0008d7287e
😎 Deploy Preview https://deploy-preview-11970--authentik-docs.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify site configuration.

@netlify Netlify
Copy link

netlify bot commented Nov 8, 2024 •
edited
Loading

✅ Deploy Preview for authentik-storybook ready!

Name Link
🔨 Latest commit 388ebcd
🔍 Latest deploy log https://app.netlify.com/sites/authentik-storybook/deploys/6732131c618f730008d7d89f
😎 Deploy Preview https://deploy-preview-11970--authentik-storybook.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify site configuration.

@codecov Codecov
Copy link

codecov bot commented Nov 8, 2024 •
edited
Loading

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 92.64%. Comparing base (cdea9a9) to head (388ebcd).
Report is 11 commits behind head on main.

Additional details and impacted files 
@@           Coverage Diff           @@
##             main   #11970   +/-   ##
=======================================
  Coverage   92.64%   92.64%           
=======================================
  Files         761      761           
  Lines       37813    37822    +9     
=======================================
+ Hits        35030    35042   +12     
+ Misses       2783     2780    -3
Flag Coverage Δ
e2e 49.31% <ø> (+0.10%) ⬆️
integration 24.91% <ø> (-0.01%) ⬇️
unit 90.15% <ø> (-0.01%) ⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@github-actions GitHub Actions
Copy link
Contributor

github-actions bot commented Nov 8, 2024 •
edited
Loading

authentik PR Installation instructions

Instructions for docker-compose

Add the following block to your .env file:

AUTHENTIK_IMAGE=ghcr.io/goauthentik/dev-server
AUTHENTIK_TAG=gh-6740d97b3f8f60b881d11cf1a521ab9b3c046b3b
AUTHENTIK_OUTPOSTS__CONTAINER_IMAGE_BASE=ghcr.io/goauthentik/dev-%(type)s:gh-%(build_hash)s

For arm64, use these values:

AUTHENTIK_IMAGE=ghcr.io/goauthentik/dev-server
AUTHENTIK_TAG=gh-6740d97b3f8f60b881d11cf1a521ab9b3c046b3b-arm64
AUTHENTIK_OUTPOSTS__CONTAINER_IMAGE_BASE=ghcr.io/goauthentik/dev-%(type)s:gh-%(build_hash)s

Afterwards, run the upgrade commands from the latest release notes.

Instructions for Kubernetes

Add the following block to your values.yml file:

authentik:
    outposts:
        container_image_base: ghcr.io/goauthentik/dev-%(type)s:gh-%(build_hash)s
global:
    image:
        repository: ghcr.io/goauthentik/dev-server
        tag: gh-6740d97b3f8f60b881d11cf1a521ab9b3c046b3b

For arm64, use these values:

authentik:
    outposts:
        container_image_base: ghcr.io/goauthentik/dev-%(type)s:gh-%(build_hash)s
global:
    image:
        repository: ghcr.io/goauthentik/dev-server
        tag: gh-6740d97b3f8f60b881d11cf1a521ab9b3c046b3b-arm64

Afterwards, run the upgrade commands from the latest release notes.

tanberry
tanberry requested changes Nov 8, 2024
View reviewed changes
Copy link
Contributor

@tanberry tanberry left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

A few editing thangs.

website/docs/security/security-hardening.md Outdated Show resolved Hide resolved
website/docs/security/security-hardening.md Outdated Show resolved Hide resolved
website/docs/security/security-hardening.md Outdated Show resolved Hide resolved
gergosimonyi and others added 2 commits November 9, 2024 20:46
@gergosimonyi @tanberry
re-word docs
0b77470 
Co-authored-by: Tana M Berry <[email protected]>
Signed-off-by: Simonyi Gergő <[email protected]>
@gergosimonyi
fix typo
6740d97
tanberry
tanberry reviewed Nov 11, 2024
View reviewed changes
website/docs/security/security-hardening.md Outdated
### Content Security Policy (CSP)

:::caution
Setting up CSP incorrectly may result in the client not loading necessary third-party code.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
Setting up CSP incorrectly may result in the client not loading necessary third-party code.
Setting up CSP incorrectly might result in the client not loading necessary third-party code.

tanberry
tanberry reviewed Nov 11, 2024
View reviewed changes
website/docs/security/security-hardening.md Outdated

Content Security Policy (CSP) is a security standard that mitigates the risk of content injection vulnerabilities. authentik doesn't currently support CSP natively, so setting it up depends on your installation. We recommend using a [reverse proxy](../install-config/reverse-proxy.md) to set a CSP header.

authentik will require at least the following origins:
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
authentik will require at least the following origins:
authentik requires at least the following origins:

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should we explain more about what an origin is? Where to define it? Do we have any links about it to link to?

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Offline resolution: we should use the word used by the CSP spec: "location"

tanberry
tanberry requested changes Nov 11, 2024
View reviewed changes
Copy link
Contributor

@tanberry tanberry left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I thought I had edited that use of "may" before, but maybe I missed this one. (We want to use "might", to imply chances, instead of "may" which implies permission. :-)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@tanberry tanberry tanberry approved these changes

@BeryJu BeryJu Awaiting requested review from BeryJu

@fheisler fheisler Awaiting requested review from fheisler

At least 1 approving review is required to merge this pull request.

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@gergosimonyi @fheisler @tanberry