Infrastructure/logto
0
Fork 0
mirror of https://github.com/logto-io/logto.git synced 2025-02-17 22:04:19 -05:00
Code Issues Activity

refactor: remove app insights domains from security headers (#5814)

Browse source
This commit is contained in:
Gao Sun 2024-05-01 23:49:30 +08:00 • committed by GitHub
parent a9ccfc738d
commit ac3575a023
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 2 additions and 9 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

11
packages/core/src/middleware/koa-security-headers.ts
View file

@ -37,7 +37,6 @@ export default function koaSecurityHeaders<StateT, ContextT, ResponseBodyT>(
const adminOrigins = isCloud ? cloudUrlSet.origins : adminUrlSet.origins;
const coreOrigins = urlSet.origins;
const developmentOrigins = conditionalArray(!isProduction && 'ws:');
const appInsightsOrigins = ['https://*.applicationinsights.azure.com'];
// We use react-monaco-editor for code editing in the admin console. It loads the monaco editor asynchronously from a CDN.
// Allow the CDN src in the CSP.
@ -92,7 +91,7 @@ export default function koaSecurityHeaders<StateT, ContextT, ResponseBodyT>(
"'unsafe-inline'",
...conditionalArray(!isProduction && "'unsafe-eval'"),
],
connectSrc: ["'self'", tenantEndpointOrigin, ...developmentOrigins, ...appInsightsOrigins],
connectSrc: ["'self'", tenantEndpointOrigin, ...developmentOrigins],
// WARNING: high risk Need to allow self hosted terms of use page loaded in an iframe
frameSrc: ["'self'", 'https:'],
// Alow loaded by console preview iframe
@ -117,13 +116,7 @@ export default function koaSecurityHeaders<StateT, ContextT, ResponseBodyT>(
...conditionalArray(!isProduction && ["'unsafe-eval'", "'unsafe-inline'"]),
...monacoEditorCDNSource,
],
connectSrc: [
"'self'",
...adminOrigins,
...coreOrigins,
...developmentOrigins,
...appInsightsOrigins,
],
connectSrc: ["'self'", ...adminOrigins, ...coreOrigins, ...developmentOrigins],
// Allow Main Flow origin loaded in preview iframe
frameSrc: ["'self'", ...adminOrigins, ...coreOrigins],
},