From 53b6044ff8687b6be0f9a0643529c666ea4b6cc5 Mon Sep 17 00:00:00 2001 From: gbrodman Date: Thu, 23 Jul 2026 17:00:18 -0400 Subject: [PATCH] Fix CSP directive in production (#3176) In prod, when loading the console, we were failing to get some scripts/styles with the error "Executing inline event handler violates the following Content Security Policy directive 'script-src 'self''. Either the 'unsafe-inline' keyword, a hash ('sha256-...'), or a nonce ('nonce- ...') is required to enable inline execution. Note that hashes do not apply to event handlers, style attributes and javascript: navigations unless the 'unsafe-hashes' keyword is present. The action has been blocked." We fix this by disabling inline-critical optimization for prod in the angular file. In addition, the web.xml header values are comma-separated -- we forgot one comma before. --- console-webapp/angular.json | 8 ++++++++ jetty/src/main/jetty-base/webapps/console/WEB-INF/web.xml | 4 ++-- 2 files changed, 10 insertions(+), 2 deletions(-) diff --git a/console-webapp/angular.json b/console-webapp/angular.json index ca1d327b3..d67130a8c 100644 --- a/console-webapp/angular.json +++ b/console-webapp/angular.json @@ -61,6 +61,14 @@ "with": "src/environments/environment.prod.ts" } ], + "optimization": { + "scripts": true, + "styles": { + "minify": true, + "inlineCritical": false + }, + "fonts": true + }, "outputHashing": "all" }, "sandbox": { diff --git a/jetty/src/main/jetty-base/webapps/console/WEB-INF/web.xml b/jetty/src/main/jetty-base/webapps/console/WEB-INF/web.xml index 2e85fae97..f757cb05c 100644 --- a/jetty/src/main/jetty-base/webapps/console/WEB-INF/web.xml +++ b/jetty/src/main/jetty-base/webapps/console/WEB-INF/web.xml @@ -9,8 +9,8 @@ headerConfig - set Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; object-src 'none'; base-uri 'self'; - set X-Content-Type-Options: nosniff + set Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; object-src 'none'; base-uri 'self';, + set X-Content-Type-Options: nosniff, set X-Frame-Options: DENY