|
Lines 514-534
__END_SRU_PUBLICSERVER__
Link Here
|
| 514 |
csp_header_value: The CSP policy directives. Special placeholders: |
514 |
csp_header_value: The CSP policy directives. Special placeholders: |
| 515 |
- _CSP_NONCE_: Replaced with a unique nonce for each request |
515 |
- _CSP_NONCE_: Replaced with a unique nonce for each request |
| 516 |
|
516 |
|
| 517 |
Recommended workflow: |
517 |
NOTE: Koha comes with a hard-coded csp_header_value. You only need to define your own |
| 518 |
1. Start with report-only mode to identify violations |
518 |
csp_header_value if you want or need a different Content-Security-Policy value. |
| 519 |
2. Review logs and fix any legitimate violations |
519 |
|
| 520 |
3. Switch to enabled mode once violations are resolved |
520 |
To enable violation reporting, create your own csp_header_value including |
|
|
521 |
'report-to' pointing to csp-violations and add 'report-uri'. |
| 522 |
|
| 523 |
NOTE: You must be using HTTPS to receive violation reports. |
| 521 |
|
524 |
|
| 522 |
To enable violation reporting, add report-to to your policy pointing to csp-violations. |
|
|
| 523 |
Example with reporting: |
525 |
Example with reporting: |
| 524 |
<csp_header_value>default-src 'self'; script-src 'self' 'nonce-_CSP_NONCE_'; style-src 'self' 'nonce-_CSP_NONCE_'; style-src-attr 'unsafe-inline'; img-src 'self' data:; font-src 'self'; object-src 'none'; report-uri /api/v1/public/csp-reports; report-to csp-violations</csp_header_value> |
526 |
<content_security_policy> |
|
|
527 |
<opac> |
| 528 |
<csp_mode>report-only</csp_mode> |
| 529 |
<csp_header_value>default-src 'self'; script-src 'self' 'nonce-_CSP_NONCE_'; style-src 'self' 'nonce-_CSP_NONCE_'; style-src-attr 'unsafe-inline'; img-src 'self' data:; font-src 'self'; object-src 'none'; report-uri /api/v1/public/csp-reports; report-to csp-violations</csp_header_value> |
| 530 |
</opac> |
| 531 |
<intranet> |
| 532 |
<csp_mode>report-only</csp_mode> |
| 533 |
<csp_header_value>default-src 'self'; script-src 'self' 'nonce-_CSP_NONCE_'; style-src 'self' 'nonce-_CSP_NONCE_'; style-src-attr 'unsafe-inline'; img-src 'self' data:; font-src 'self'; object-src 'none'; report-uri /api/v1/public/csp-reports; report-to csp-violations</csp_header_value> |
| 534 |
</intranet> |
| 535 |
</content_security_policy> |
| 525 |
|
536 |
|
| 526 |
Reports are logged via Koha's logging system. Configure log4perl to capture them: |
537 |
Reports are logged via Koha's logging system. Configure log4perl to capture them: |
| 527 |
log4perl.logger.api.csp = WARN, CSP |
538 |
log4perl.logger.plack-csp = WARN, PLACKCSP |
| 528 |
log4perl.appender.CSP = Log::Log4perl::Appender::File |
539 |
log4perl.appender.PLACKCSP=Log::Log4perl::Appender::File |
| 529 |
log4perl.appender.CSP.filename = /var/log/koha/__KOHASITE__/csp-violations.log |
540 |
log4perl.appender.PLACKCSP.filename=/var/log/koha/<kohasite>/plack-csp-violations.log |
| 530 |
log4perl.appender.CSP.layout = PatternLayout |
541 |
log4perl.appender.PLACKCSP.mode=append |
| 531 |
log4perl.appender.CSP.layout.ConversionPattern = [%d] %m%n |
542 |
log4perl.appender.PLACKCSP.layout=PatternLayout |
|
|
543 |
log4perl.appender.PLACKCSP.layout.ConversionPattern=[%d] %m%n |
| 544 |
log4perl.appender.PLACKCSP.utf8=1 |
| 545 |
|
| 546 |
Recommended workflow: |
| 547 |
1. Start with report-only mode to identify violations |
| 548 |
2. Review logs and fix any legitimate violations (by fixing the code or by modifying your csp_header_value) |
| 549 |
3. Switch to enabled mode once violations are resolved |
| 532 |
--> |
550 |
--> |
| 533 |
<content_security_policy> |
551 |
<content_security_policy> |
| 534 |
<opac> |
552 |
<opac> |