mgr/dashboard: set security headers

Fixes: https://tracker.ceph.com/issues/49243
Signed-off-by: Avan Thakkar <athakkar@redhat.com>
(cherry picked from commit 87bb3777877580f70018f4880488e264decc16e4)

 Conflicts:
	qa/tasks/mgr/dashboard/test_requests.py
	src/pybind/mgr/dashboard/services/auth.py
      - Adopting the master branch changes.

diff --git a/qa/tasks/mgr/dashboard/test_requests.py b/qa/tasks/mgr/dashboard/test_requests.py
index 25460914866ad21c96e864f7724b4b04476ae74f..cd917daeb031394471e95051fe454678199d07fa 100644 (file)
--- a/qa/tasks/mgr/dashboard/test_requests.py
+++ b/qa/tasks/mgr/dashboard/test_requests.py
@@ -25,5 +25,8 @@ class RequestsTest(DashboardTestCase):
     def test_server(self):
         self._get('/api/summary')
         self.assertHeaders({
-            'server': 'Ceph-Dashboard'
-        })
\ No newline at end of file
+            'server': 'Ceph-Dashboard',
+            'Content-Security-Policy': "frame-ancestors 'self';",
+            'X-Content-Type-Options': 'nosniff',
+            'Strict-Transport-Security': 'max-age=63072000; includeSubDomains; preload'
+        })

diff --git a/qa/tasks/mgr/test_prometheus.py b/qa/tasks/mgr/test_prometheus.py
index 63a4abe00dbba0dc82460c1b4912c0b5cf21617e..376556ab30536e925b38d8e2286cc2a2aa7787d6 100644 (file)
--- a/qa/tasks/mgr/test_prometheus.py
+++ b/qa/tasks/mgr/test_prometheus.py
@@ -48,6 +48,7 @@ class TestPrometheus(MgrTestCase):
         r = requests.get(original_uri + "metrics", allow_redirects=False)
         self.assertEqual(r.status_code, 200)
         self.assertEqual(r.headers["content-type"], "text/plain;charset=utf-8")
+        self.assertEqual(r.headers["server"], "Ceph-Prometheus")
 
     def test_urls(self):
         self._assign_ports("prometheus", "server_port")

diff --git a/src/pybind/mgr/dashboard/services/auth.py b/src/pybind/mgr/dashboard/services/auth.py
index 3ae5121be5f8c1cac314ec8c4f5b48a29c23bfba..79350bbddbd253c1c5b93d77bba753922d8de9ff 100644 (file)
--- a/src/pybind/mgr/dashboard/services/auth.py
+++ b/src/pybind/mgr/dashboard/services/auth.py
@@ -15,8 +15,11 @@ from .access_control import LocalAuthenticator, UserDoesNotExist
 from .. import mgr, logger
 
 cherrypy.config.update({
-    'response.headers.server': 'Ceph-Dashboard'
-    })
+    'response.headers.server': 'Ceph-Dashboard',
+    'response.headers.content-security-policy': "frame-ancestors 'self';",
+    'response.headers.x-content-type-options': 'nosniff',
+    'response.headers.strict-transport-security': 'max-age=63072000; includeSubDomains; preload'
+})
 
 
 class JwtManager(object):

diff --git a/src/pybind/mgr/prometheus/module.py b/src/pybind/mgr/prometheus/module.py
index a1496a9f69e447cdcc02456eaab1451100fae5ca..9b2efc26f09f570bcf1bde5d30c2869927ae7df4 100644 (file)
--- a/src/pybind/mgr/prometheus/module.py
+++ b/src/pybind/mgr/prometheus/module.py
@@ -48,6 +48,9 @@ os._exit = os_exit_noop
 # it's a dict, the writer doesn't need to declare 'global' for access
 
 _global_instance = None  # type: Optional[Module]
+cherrypy.config.update({
+    'response.headers.server': 'Ceph-Prometheus'
+})
 
 
 def health_status_to_number(status):