[7.17] Add CSP header to all requests, including api requests (#144902)…

… (#145553) # Backport This will backport the following commits from `main` to `7.17`: - [Add CSP header to all requests, including api requests (#144902)](#144902)  ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sqren/backport) \n\n### Questions ?\nPlease refer to the [Backport tool\ndocumentation](https://github.com/sqren/backport)\n\n\n\nCo-authored-by: Thomas Watson <[email protected]>"}},{"branch":"main","label":"v8.7.0","labelRegex":"^v8.7.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/144902","number":144902,"mergeCommit":{"message":"Add CSP header to all requests, including api requests (#144902)\n\nPreviously `/api/*` requests didn't include a `Content-Security-Policy`\r\nheader, now they do.\r\n\r\nCloses #143871","sha":"5550ab6cb10fbfddf437a74900103bb33dd1afa4"}}]}] BACKPORT--> Co-authored-by: Kibana Machine <[email protected]>
elastic · Nov 21, 2022 · 18c40db · 18c40db
1 parent 7b7b3e3
commit 18c40db
Show file tree

Hide file tree

Showing 7 changed files with 79 additions and 72 deletions.
diff --git a/src/core/server/http/http_service.ts b/src/core/server/http/http_service.ts
@@ -103,6 +103,8 @@ export class HttpService
       },
     });
 
+    registerCoreHandlers(prebootSetup, config, this.env);
+
     if (this.shouldListen(config)) {
       this.log.debug('starting preboot server');
       await this.prebootServer.start();

diff --git a/src/core/server/http/integration_tests/lifecycle.test.ts b/src/core/server/http/integration_tests/lifecycle.test.ts
@@ -1453,6 +1453,32 @@ describe('OnPreResponse', () => {
   });
 });
 
+describe('runs with default preResponse handlers', () => {
+  it('does not allow overwriting of the "kbn-name" and "Content-Security-Policy" headers', async () => {
+    const { server: innerServer, createRouter } = await server.setup(setupDeps);
+    const router = createRouter('/');
+
+    router.get({ path: '/', validate: false }, (context, req, res) =>
+      res.ok({
+        headers: {
+          foo: 'bar',
+          'kbn-name': 'hijacked!',
+          'Content-Security-Policy': 'hijacked!',
+        },
+      })
+    );
+    await server.start();
+
+    const response = await supertest(innerServer.listener).get('/').expect(200);
+
+    expect(response.header.foo).toBe('bar');
+    expect(response.header['kbn-name']).toBe('kibana');
+    expect(response.header['content-security-policy']).toBe(
+      `script-src 'unsafe-eval' 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'`
+    );
+  });
+});
+
 describe('run interceptors in the right order', () => {
   it('with Auth registered', async () => {
     const {

diff --git a/src/core/server/http/lifecycle_handlers.test.ts b/src/core/server/http/lifecycle_handlers.test.ts
@@ -231,19 +231,40 @@ describe('customHeaders pre-response handler', () => {
     toolkit = httpServerMock.createToolkit();
   });
 
-  it('adds the kbn-name header to the response', () => {
-    const config = createConfig({ name: 'my-server-name' });
+  it('adds the kbn-name and Content-Security-Policy headers to the response', () => {
+    const config = createConfig({
+      name: 'my-server-name',
+      csp: {
+        rules: [],
+        strict: true,
+        warnLegacyBrowsers: true,
+        disableEmbedding: true,
+        header: 'foo',
+      },
+    });
     const handler = createCustomHeadersPreResponseHandler(config as HttpConfig);
 
     handler({} as any, {} as any, toolkit);
 
     expect(toolkit.next).toHaveBeenCalledTimes(1);
-    expect(toolkit.next).toHaveBeenCalledWith({ headers: { 'kbn-name': 'my-server-name' } });
+    expect(toolkit.next).toHaveBeenCalledWith({
+      headers: {
+        'Content-Security-Policy': 'foo',
+        'kbn-name': 'my-server-name',
+      },
+    });
   });
 
   it('adds the security headers and custom headers defined in the configuration', () => {
     const config = createConfig({
       name: 'my-server-name',
+      csp: {
+        rules: [],
+        strict: true,
+        warnLegacyBrowsers: true,
+        disableEmbedding: true,
+        header: 'foo',
+      },
       securityResponseHeaders: {
         headerA: 'value-A',
         headerB: 'value-B', // will be overridden by the custom response header below
@@ -259,18 +280,27 @@ describe('customHeaders pre-response handler', () => {
     expect(toolkit.next).toHaveBeenCalledTimes(1);
     expect(toolkit.next).toHaveBeenCalledWith({
       headers: {
+        'Content-Security-Policy': 'foo',
         'kbn-name': 'my-server-name',
         headerA: 'value-A',
         headerB: 'x',
       },
     });
   });
 
-  it('preserve the kbn-name value from server.name if definied in custom headders ', () => {
+  it('do not allow overwrite of the kbn-name and Content-Security-Policy headers if defined in custom headders ', () => {
     const config = createConfig({
       name: 'my-server-name',
+      csp: {
+        rules: [],
+        strict: true,
+        warnLegacyBrowsers: true,
+        disableEmbedding: true,
+        header: 'foo',
+      },
       customResponseHeaders: {
         'kbn-name': 'custom-name',
+        'Content-Security-Policy': 'custom-csp',
         headerA: 'value-A',
         headerB: 'value-B',
       },
@@ -283,6 +313,7 @@ describe('customHeaders pre-response handler', () => {
     expect(toolkit.next).toHaveBeenCalledWith({
       headers: {
         'kbn-name': 'my-server-name',
+        'Content-Security-Policy': 'foo',
         headerA: 'value-A',
         headerB: 'value-B',
       },

diff --git a/src/core/server/http/lifecycle_handlers.ts b/src/core/server/http/lifecycle_handlers.ts
@@ -62,12 +62,18 @@ export const createVersionCheckPostAuthHandler = (kibanaVersion: string): OnPost
 };
 
 export const createCustomHeadersPreResponseHandler = (config: HttpConfig): OnPreResponseHandler => {
-  const { name: serverName, securityResponseHeaders, customResponseHeaders } = config;
+  const {
+    name: serverName,
+    securityResponseHeaders,
+    customResponseHeaders,
+    csp: { header: cspHeader },
+  } = config;
 
   return (request, response, toolkit) => {
     const additionalHeaders = {
       ...securityResponseHeaders,
       ...customResponseHeaders,
+      'Content-Security-Policy': cspHeader,
       [KIBANA_NAME_HEADER]: serverName,
     };
 

diff --git a/src/core/server/http/test_utils.ts b/src/core/server/http/test_utils.ts
@@ -25,6 +25,7 @@ const configService = configServiceMock.create();
 configService.atPath.mockImplementation((path) => {
   if (path === 'server') {
     return new BehaviorSubject({
+      name: 'kibana',
       hosts: ['localhost'],
       maxPayload: new ByteSizeValue(1024),
       autoListen: true,

diff --git a/src/core/server/http_resources/http_resources_service.test.ts b/src/core/server/http_resources/http_resources_service.test.ts
@@ -56,6 +56,7 @@ describe('HttpResources service', () => {
       describe(`${name} register`, () => {
         const routeConfig: RouteConfig<any, any, any, 'get'> = { path: '/', validate: false };
         let register: HttpResources['register'];
+
         beforeEach(async () => {
           register = await initializer();
         });
@@ -80,32 +81,8 @@ describe('HttpResources service', () => {
               }
             );
           });
-
-          it('can attach headers, except the CSP header', async () => {
-            register(routeConfig, async (ctx, req, res) => {
-              return res.renderCoreApp({
-                headers: {
-                  'content-security-policy': "script-src 'unsafe-eval'",
-                  'x-kibana': '42',
-                },
-              });
-            });
-
-            const [[, routeHandler]] = router.get.mock.calls;
-
-            const responseFactory = httpResourcesMock.createResponseFactory();
-            await routeHandler(context, kibanaRequest, responseFactory);
-
-            expect(responseFactory.ok).toHaveBeenCalledWith({
-              body: '<body />',
-              headers: {
-                'x-kibana': '42',
-                'content-security-policy':
-                  "script-src 'unsafe-eval' 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'",
-              },
-            });
-          });
         });
+
         describe('renderAnonymousCoreApp', () => {
           it('formats successful response', async () => {
             register(routeConfig, async (ctx, req, res) => {
@@ -126,32 +103,8 @@ describe('HttpResources service', () => {
               }
             );
           });
-
-          it('can attach headers, except the CSP header', async () => {
-            register(routeConfig, async (ctx, req, res) => {
-              return res.renderAnonymousCoreApp({
-                headers: {
-                  'content-security-policy': "script-src 'unsafe-eval'",
-                  'x-kibana': '42',
-                },
-              });
-            });
-
-            const [[, routeHandler]] = router.get.mock.calls;
-
-            const responseFactory = httpResourcesMock.createResponseFactory();
-            await routeHandler(context, kibanaRequest, responseFactory);
-
-            expect(responseFactory.ok).toHaveBeenCalledWith({
-              body: '<body />',
-              headers: {
-                'x-kibana': '42',
-                'content-security-policy':
-                  "script-src 'unsafe-eval' 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'",
-              },
-            });
-          });
         });
+
         describe('renderHtml', () => {
           it('formats successful response', async () => {
             const htmlBody = '<html><body /></html>';
@@ -166,20 +119,17 @@ describe('HttpResources service', () => {
               body: htmlBody,
               headers: {
                 'content-type': 'text/html',
-                'content-security-policy':
-                  "script-src 'unsafe-eval' 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'",
               },
             });
           });
 
-          it('can attach headers, except the CSP & "content-type" headers', async () => {
+          it('can attach headers, except the "content-type" header', async () => {
             const htmlBody = '<html><body /></html>';
             register(routeConfig, async (ctx, req, res) => {
               return res.renderHtml({
                 body: htmlBody,
                 headers: {
                   'content-type': 'text/html5',
-                  'content-security-policy': "script-src 'unsafe-eval'",
                   'x-kibana': '42',
                 },
               });
@@ -195,12 +145,11 @@ describe('HttpResources service', () => {
               headers: {
                 'content-type': 'text/html',
                 'x-kibana': '42',
-                'content-security-policy':
-                  "script-src 'unsafe-eval' 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'",
               },
             });
           });
         });
+
         describe('renderJs', () => {
           it('formats successful response', async () => {
             const jsBody = 'alert(1);';
@@ -215,20 +164,17 @@ describe('HttpResources service', () => {
               body: jsBody,
               headers: {
                 'content-type': 'text/javascript',
-                'content-security-policy':
-                  "script-src 'unsafe-eval' 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'",
               },
             });
           });
 
-          it('can attach headers, except the CSP & "content-type" headers', async () => {
+          it('can attach headers, except the "content-type" header', async () => {
             const jsBody = 'alert(1);';
             register(routeConfig, async (ctx, req, res) => {
               return res.renderJs({
                 body: jsBody,
                 headers: {
                   'content-type': 'text/html',
-                  'content-security-policy': "script-src 'unsafe-eval'",
                   'x-kibana': '42',
                 },
               });
@@ -244,8 +190,6 @@ describe('HttpResources service', () => {
               headers: {
                 'content-type': 'text/javascript',
                 'x-kibana': '42',
-                'content-security-policy':
-                  "script-src 'unsafe-eval' 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'",
               },
             });
           });

diff --git a/src/core/server/http_resources/http_resources_service.ts b/src/core/server/http_resources/http_resources_service.ts
@@ -89,7 +89,6 @@ export class HttpResourcesService implements CoreService<InternalHttpResourcesSe
     request: KibanaRequest,
     response: KibanaResponseFactory
   ): HttpResourcesServiceToolkit {
-    const cspHeader = deps.http.csp.header;
     return {
       async renderCoreApp(options: HttpResourcesRenderOptions = {}) {
         const apmConfig = getApmConfig(request.url.pathname);
@@ -103,7 +102,7 @@ export class HttpResourcesService implements CoreService<InternalHttpResourcesSe
 
         return response.ok({
           body,
-          headers: { ...options.headers, 'content-security-policy': cspHeader },
+          headers: options.headers,
         });
       },
       async renderAnonymousCoreApp(options: HttpResourcesRenderOptions = {}) {
@@ -118,7 +117,7 @@ export class HttpResourcesService implements CoreService<InternalHttpResourcesSe
 
         return response.ok({
           body,
-          headers: { ...options.headers, 'content-security-policy': cspHeader },
+          headers: options.headers,
         });
       },
       renderHtml(options: HttpResourcesResponseOptions) {
@@ -127,7 +126,6 @@ export class HttpResourcesService implements CoreService<InternalHttpResourcesSe
           headers: {
             ...options.headers,
             'content-type': 'text/html',
-            'content-security-policy': cspHeader,
           },
         });
       },
@@ -137,7 +135,6 @@ export class HttpResourcesService implements CoreService<InternalHttpResourcesSe
           headers: {
             ...options.headers,
             'content-type': 'text/javascript',
-            'content-security-policy': cspHeader,
           },
         });
       },