Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

website/docs: add CSP to hardening #11970

Open
wants to merge 5 commits into
base: main
Choose a base branch
from
Open

website/docs: add CSP to hardening #11970

Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
a9e73df
add CSP to hardening
gergosimonyi Nov 8, 2024
0b77470
re-word docs
gergosimonyi Nov 9, 2024
6740d97
fix typo
gergosimonyi Nov 9, 2024
9b71d3f
use the correct term "location" instead of "origin" in CSP docs
gergosimonyi Nov 11, 2024
388ebcd
reword docs
gergosimonyi Nov 11, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 25 additions & 0 deletions website/docs/security/security-hardening.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,3 +36,28 @@ To prevent any user from creating/editing CAPTCHA stages block API requests to t
- `/api/v3/managed/blueprints*`

With these restrictions in place, CAPTCHA stages can only be edited using [Blueprints on the file system](../customize/blueprints/index.md#storage---file).

### Content Security Policy (CSP)

:::caution
Setting up CSP incorrectly might result in the client not loading necessary third-party code.
:::

Content Security Policy (CSP) is a security standard that mitigates the risk of content injection vulnerabilities. authentik doesn't currently support CSP natively, so setting it up depends on your installation. We recommend using a [reverse proxy](../install-config/reverse-proxy.md) to set a CSP header.

authentik requires at least the following allowed locations:

```
default-src 'self';
style-src 'self' 'unsafe-inline';
script-src 'self' 'unsafe-inline';
img-src 'https:' 'http:' 'data:';
object-src 'none';
```

Your use case might require more allowed locations for various directives, e.g.

- when using a CAPTCHA service
- when using Sentry
- when using any custom JavaScript in a prompt stage
- when using Spotlight Sidecar for development
Loading