CSP headers break schema

[Coperh]

Product versie / Product version

0.8.0

Omschrijf het probleem / Describe the bug

CSP headers prevent schema from loading external scripts

Reported here, maykinmedia/open-klant#242/

Confirmed in OpenZaak 1.14

Stappen om te reproduceren / Steps to reproduce

1. Go to open-klant /contactgegevens/api/v1/schema/

Verwacht gedrag / Expected behavior

Page should loader correctly

[Coperh]

Three potential fixes:

Exclude the schema URLs. This is the quick way but does need to include all component URLs since they are "prefixes"

# for open klant
CSP_EXCLUDE_URL_PREFIXES += (
    "/contactgegevens/api/v1/schema/",
    "/klantinteracties/api/v1/schema/"
)

Allow sources for SCP

# used for DRF Spectacular
CSP_FONT_SRC = ("'self'", "fonts.gstatic.com")
CSP_WORKER_SRC = ("'self'", "blob:")

CSP_DEFAULT_SRC += ["'unsafe-inline'"] # Open zaak might want this anyway
CSP_IMG_SRC += ["cdn.redoc.ly", "data:"]
CSP_SCRIPT_SRC += ["cdn.jsdelivr.net"]
CSP_STYLE_SRC += ["fonts.googleapis.com"]

Also might be extra per project source e.g. OZ wants the vng github

The more proper way might be to install drf-spectacular-sidecar https://drf-spectacular.readthedocs.io/en/latest/faq.html#my-swagger-ui-and-or-redoc-page-is-blank

[Coperh]

See https://test.openzaak.nl/zaken/api/v1/schema/

[alextreme]

Looking at drf-spectacular-sidecar, this seems to me to be the proper route. If you don't need externally hosted scripts served via a CDN then setting CSP headers site-wide becomes a lot easier. This combined with the move from yasg to spectacular for OZ means that this should work for all components.

As an aside, Sergei pointed out that /admin was also excluded in CSP_EXCLUDE_URL_PREFIXES. This shouldn't be the case (the whole reason why we added CSP to OAf was for /admin.

open-api-framework/open_api_framework/conf/base.py

Line 1042 in 9ef90bb

"/admin/",

[joeribekker]

Refinement:,Will be fixed in all components.