Verursacht DISCOURSE_CDN_URL Content-Security-Policy-Verstöße?

pfaffman · 6. Februar 2020 um 21:51

Ich weiß nicht, wie ich das so falsch mache. Ich kann nicht verstehen, warum ich der Einzige bin, der mit einem vermeintlichen Fehler konfrontiert ist.

Wenn ich

  DISCOURSE_CDN_URL: https://lcsupport-92e2.kxcdn.com

im env:-Abschnitt meiner yml-Datei für eine relativ Standard-Multisite-Konfiguration definiere, werden alle CDN-URLs vom Browser aufgrund eines CSP-Fehlers abgelehnt.

content security policy script src behauptet: „Zusätzlich freigegebene Skriptquellen. Der aktuelle Host und das CDN sind standardmäßig enthalten. Siehe XSS-Angriffe mit Content Security Policy abmildern.". Doch wenn ich es definiere (oder es in discourse.conf hinzufüge/entferne und sv restart unicorn ausführe), erhalte ich folgende Meldung:

Selbst wenn content security policy report only auf true gesetzt ist, wird die Seite nicht geladen.

Es scheint erforderlich zu sein, content_security_policy zu deaktivieren oder die CDN-URL zu content security policy script src hinzuzufügen, damit der Browser die Assets laden kann.

Hier ist meine yml-Datei.

xrav3nz · 6. Februar 2020 um 22:14

CDN URLs should be computed and included in the CSP by default. Could you also provide (or try comparing) the actual CSP served in the header and the source of the blocked assets?

pfaffman · 6. Februar 2020 um 22:45

Here is the header:

content-security-policy-report-only: base-uri 'none'; object-src 'none'; script-src 'report-sample' 
https://support.literatecomputing.com/logs/ 
https://support.literatecomputing.com/sidekiq/ 
https://support.literatecomputing.com/mini-profiler-resources/ 
https://abedmulti-92e2.kxcdn.com/uploads/assets/ 
https://abedmulti-92e2.kxcdn.com/uploads/brotli_asset/ 
https://support.literatecomputing.com/extra-locales/ 
https://lcsupport-92e2.kxcdn.com/highlight-js/ 
https://lcsupport-92e2.kxcdn.com/javascripts/ 
https://lcsupport-92e2.kxcdn.com/plugins/ 
https://lcsupport-92e2.kxcdn.com/theme-javascripts/ 
https://lcsupport-92e2.kxcdn.com/svg-sprite/ 
https://www.google-analytics.com/analytics.js 
https://tagmanager.google.com/ 
https://www.googletagmanager.com/; worker-src 'self' blob:

Here are the ENV variables inside the container:

root@support-multi:/var/www/discourse# echo $DISCOURSE_S3_UPLOAD_BUCKET 
abed-multi/uploads
root@support-multi:/var/www/discourse# echo $DISCOURSE_S3_CDN_URL 
https://abedmulti-92e2.kxcdn.com/uploads

Here is the CDN URL from discourse.conf:

cdn_url = 'https://lcsupport-92e2.kxcdn.com'

and rails:

[1] pry(main)> GlobalSetting.cdn_url
=> "https://lcsupport-92e2.kxcdn.com"

And here is the URL for one of the assets that won’t load: https://lcsupport-92e2.kxcdn.com/brotli_asset/preload-store-d32dcf974dddcac742f8a7a6aa7fcd686185920b201029d0ecb2b85527ef9034.js

xrav3nz · 6. Februar 2020 um 23:11

So we have this in the CSP

https://abedmulti-92e2.kxcdn.com/uploads/assets/ 
https://abedmulti-92e2.kxcdn.com/uploads/brotli_asset/
# i.e. DISCOURSE_S3_CDN_URL + /brotli_asset/

But the actual address is

https://lcsupport-92e2.kxcdn.com/brotli_asset/preload-store-d32dcf974dddcac742f8a7a6aa7fcd686185920b201029d0ecb2b85527ef9034.js
# i.e. DISCOURSE_CDN_URL + /brotli_asset/...

The relevant CSP code:

github.com/discourse/discourse

lib/content_security_policy/default.rb

49843f327


      
            # [dir, can_use_s3_cdn, can_use_cdn]
            ['/assets/',             true, true],
            ['/brotli_asset/',       true, true],
            ['/extra-locales/',      false, false],
            ['/highlight-js/',       false, true],
            ['/javascripts/',        false, true],
            ['/plugins/',            false, true],
            ['/theme-javascripts/',  false, true],
            ['/svg-sprite/',         false, true],
          ]
          
          def script_assets(base = base_url, s3_cdn = GlobalSetting.s3_cdn_url, cdn = GlobalSetting.cdn_url)
            SCRIPT_ASSET_DIRECTORIES.map do |dir, can_use_s3_cdn, can_use_cdn|
              if can_use_s3_cdn && s3_cdn
                s3_cdn + dir
              elsif can_use_cdn && cdn
                cdn + dir
              else
                base + dir
              end

We prioritize using DISCOURSE_S3_CDN_URL for assets when available. This aligns with the CDN asset URL generation.

@pfaffman Does GlobalSetting.use_s3? return true for your site?

I wonder if we need an additional GlobalSetting.use_s3? check here. Does having GlobalSetting.s3_cdn_url necessarily imply GlobalSetting.use_s3?? I’m a bit hazy with asset genereation / S3 CDN now could someone more familiar with it also take a look? Thanks!

pfaffman · 6. Februar 2020 um 23:23

Well, I tried setting use_s3 and then rake assets:precompile and there’s no change.

I’ve somewhere else had this issue where there was confusion about whether assets were in s3 or local (or their CDN mirrors).

Thema		Antworten	Aufrufe
CDN URL must be added to csp script src Self-hosting cdn	4	737	21. Mai 2024
Admin upgrade page doesn't load with a CDN Support	4	1088	5. November 2020
Assets not serving from CDN in latest update Support	17	1798	8. März 2020
Defining DISCOURSE_S3_CDN_URL links to assets in S3 CDN URL Support	43	6352	22. April 2020
Refused to load the script 'site.com/cdn-cgi/speculation' because it violates the following Content Security Policy directive Support content-security-policy	4	8336	22. Oktober 2024

Verursacht DISCOURSE_CDN_URL Content-Security-Policy-Verstöße?

Verwandte Themen