From c18d07e07b1e636c6e1dcc2143bb743995884ce6 Mon Sep 17 00:00:00 2001 From: Avan Thakkar Date: Thu, 11 Feb 2021 03:42:49 +0530 Subject: [PATCH] mgr/dashboard: set security headers Fixes: https://tracker.ceph.com/issues/49243 Signed-off-by: Avan Thakkar (cherry picked from commit 87bb3777877580f70018f4880488e264decc16e4) Conflicts: qa/tasks/mgr/dashboard/test_requests.py src/pybind/mgr/dashboard/services/auth.py - Adopting the master branch changes. --- qa/tasks/mgr/dashboard/test_requests.py | 7 +++++-- qa/tasks/mgr/test_prometheus.py | 1 + src/pybind/mgr/dashboard/services/auth.py | 7 +++++-- src/pybind/mgr/prometheus/module.py | 3 +++ 4 files changed, 14 insertions(+), 4 deletions(-) diff --git a/qa/tasks/mgr/dashboard/test_requests.py b/qa/tasks/mgr/dashboard/test_requests.py index 25460914866ad..cd917daeb0313 100644 --- a/qa/tasks/mgr/dashboard/test_requests.py +++ b/qa/tasks/mgr/dashboard/test_requests.py @@ -25,5 +25,8 @@ class RequestsTest(DashboardTestCase): def test_server(self): self._get('/api/summary') self.assertHeaders({ - 'server': 'Ceph-Dashboard' - }) \ No newline at end of file + 'server': 'Ceph-Dashboard', + 'Content-Security-Policy': "frame-ancestors 'self';", + 'X-Content-Type-Options': 'nosniff', + 'Strict-Transport-Security': 'max-age=63072000; includeSubDomains; preload' + }) diff --git a/qa/tasks/mgr/test_prometheus.py b/qa/tasks/mgr/test_prometheus.py index 63a4abe00dbba..376556ab30536 100644 --- a/qa/tasks/mgr/test_prometheus.py +++ b/qa/tasks/mgr/test_prometheus.py @@ -48,6 +48,7 @@ class TestPrometheus(MgrTestCase): r = requests.get(original_uri + "metrics", allow_redirects=False) self.assertEqual(r.status_code, 200) self.assertEqual(r.headers["content-type"], "text/plain;charset=utf-8") + self.assertEqual(r.headers["server"], "Ceph-Prometheus") def test_urls(self): self._assign_ports("prometheus", "server_port") diff --git a/src/pybind/mgr/dashboard/services/auth.py b/src/pybind/mgr/dashboard/services/auth.py index 3ae5121be5f8c..79350bbddbd25 100644 --- a/src/pybind/mgr/dashboard/services/auth.py +++ b/src/pybind/mgr/dashboard/services/auth.py @@ -15,8 +15,11 @@ from .access_control import LocalAuthenticator, UserDoesNotExist from .. import mgr, logger cherrypy.config.update({ - 'response.headers.server': 'Ceph-Dashboard' - }) + 'response.headers.server': 'Ceph-Dashboard', + 'response.headers.content-security-policy': "frame-ancestors 'self';", + 'response.headers.x-content-type-options': 'nosniff', + 'response.headers.strict-transport-security': 'max-age=63072000; includeSubDomains; preload' +}) class JwtManager(object): diff --git a/src/pybind/mgr/prometheus/module.py b/src/pybind/mgr/prometheus/module.py index a1496a9f69e44..9b2efc26f09f5 100644 --- a/src/pybind/mgr/prometheus/module.py +++ b/src/pybind/mgr/prometheus/module.py @@ -48,6 +48,9 @@ os._exit = os_exit_noop # it's a dict, the writer doesn't need to declare 'global' for access _global_instance = None # type: Optional[Module] +cherrypy.config.update({ + 'response.headers.server': 'Ceph-Prometheus' +}) def health_status_to_number(status): -- 2.39.5