Add CSP header (#11921)

airbytehq · May 23, 2022 · 2a6936e · 2a6936e
1 parent ed1f18d
commit 2a6936e
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 0 deletions.
diff --git a/airbyte-webapp/nginx/default.conf.template b/airbyte-webapp/nginx/default.conf.template
@@ -10,6 +10,8 @@ server {
     #charset koi8-r;
     #access_log  /var/log/nginx/host.access.log  main;
 
+    add_header Content-Security-Policy "script-src * 'unsafe-inline';";
+
     location / {
         root   /usr/share/nginx/html;
         try_files $uri $uri/ /index.html;

diff --git a/airbyte-webapp/src/setupProxy.js b/airbyte-webapp/src/setupProxy.js
@@ -7,6 +7,12 @@
 const express = require("express");
 
 module.exports = (app) => {
+  // Set the CSP header in development to detect potential breakages.
+  // This should always match the header in airbyte-webapp/nginx/default.conf.template
+  app.use((req, resp, next) => {
+    resp.header("Content-Security-Policy", "script-src * 'unsafe-inline';");
+    next();
+  });
   // Serve the doc markdowns and assets that are also bundled into the docker image
   app.use("/docs/integrations", express.static(`${__dirname}/../../docs/integrations`));
   app.use("/docs/.gitbook", express.static(`${__dirname}/../../docs/.gitbook`));