Project

General

Profile

Actions
Copy link

Task #104549

closed

Activation of CSP headers for frontend per site in multidomain installation

Added by Natalie Kleine-Herzbruch 4 months ago. Updated about 1 month ago.

Status:
Closed
Priority:
Should have
Assignee:
-
Category:
Content Security Policy
Target version:
-
Start date:
2024-08-05
Due date:
% Done:

100%

Estimated time:
TYPO3 Version:
12
PHP Version:
8.2
Tags:
Complexity:
Sprint Focus:

Description

In a multidomain installation, it is currently not possible to completely disable the output of CSP headers for a site if $GLOBALS['TYPO3_CONF_VARS']['SYS']['features']['security.frontend.enforceContentSecurityPolicy'] = true. The default CSP headers are still output even if no csp.yaml file is created. It would be great if you could decide per site whether CSP should be on or off in the frontend.

Related issues 2 (0 open — 2 closed)

Related to TYPO3 Core - Task #104633: Combine disabling site-specific CSP with report-only modeClosed2024-08-15

Actions
Related to TYPO3 Core - Feature #101580: Add feature flag to enable CSP ReportOnly modeClosedOliver Hader2023-08-04

Actions
Actions
Copy link
 #1

Updated by Garvin Hicking 4 months ago

  • Status changed from New to Needs Feedback

I can't test this right now, but you could use a ContentSecurityPolicies.php file maybe and do your site detection consditionally in there?

Also https://docs.typo3.org/m/typo3/reference-coreapi/main/en-us/ApiOverview/ContentSecurityPolicy/Index.html#content-security-policy-site with maybe a csp.yaml file resetting headers to different values could work?

And if all fails, you can place a middleware after the csp one, and reset CSP headers with that?

Actions
Copy link
 #2

Updated by Garvin Hicking 4 months ago

(With middleware, check out https://forge.typo3.org/issues/104470 for a possible approach?)

Actions
Copy link
 #3

Updated by Gerrit Code Review 3 months ago

  • Status changed from Needs Feedback to Under Review

Patch set 1 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/85591

Actions
Copy link
 #4

Updated by Oliver Hader 3 months ago

I see that disabling CSP headers for a particular site might be handy. Please check & verify the referenced patch. Thx!

Actions
Copy link
 #5

Updated by Oliver Hader 3 months ago

  • Tracker changed from Feature to Task
  • PHP Version changed from 8.3 to 8.2
  • TYPO3 Version set to 12
Actions
Copy link
 #6

Updated by Gerrit Code Review 3 months ago

Patch set 1 for branch 12.4 of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/85622

Actions
Copy link
 #7

Updated by Oliver Hader 3 months ago

  • Status changed from Under Review to Resolved
  • % Done changed from 0 to 100
Actions
Copy link
 #8

Updated by Oliver Hader 3 months ago

  • Status changed from Resolved to New

→ reverts https://review.typo3.org/q/I651f60d7b5cc24133801412c8f09b1efba98d3f4
→ the behavior shall be combined with a site-specific report-only mode later

Actions
Copy link
 #9

Updated by Gerrit Code Review 3 months ago

  • Status changed from New to Under Review

Patch set 2 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/85632

Actions
Copy link
 #10

Updated by Gerrit Code Review 3 months ago

Patch set 3 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/85632

Actions
Copy link
 #11

Updated by Gerrit Code Review 3 months ago

Patch set 4 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/85632

Actions
Copy link
 #12

Updated by Gerrit Code Review 3 months ago

Patch set 5 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/85632

Actions
Copy link
 #13

Updated by Gerrit Code Review 3 months ago

Patch set 6 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/85632

Actions
Copy link
 #14

Updated by Gerrit Code Review 3 months ago

Patch set 7 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/85632

Actions
Copy link
 #15

Updated by Gerrit Code Review 3 months ago

Patch set 8 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/85632

Actions
Copy link
 #16

Updated by Gerrit Code Review 3 months ago

Patch set 9 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/85632

Actions
Copy link
 #17

Updated by Gerrit Code Review 3 months ago

Patch set 10 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/85632

Actions
Copy link
 #18

Updated by Gerrit Code Review 3 months ago

Patch set 11 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/85632

Actions
Copy link
 #19

Updated by Gerrit Code Review 3 months ago

Patch set 12 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/85632

Actions
Copy link
 #20

Updated by Gerrit Code Review 3 months ago

Patch set 13 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/85632

Actions
Copy link
 #21

Updated by Gerrit Code Review 3 months ago

Patch set 14 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/85632

Actions
Copy link
 #22

Updated by Gerrit Code Review 3 months ago

Patch set 15 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/85632

Actions
Copy link
 #23

Updated by Gerrit Code Review 3 months ago

Patch set 16 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/85632

Actions
Copy link
 #24

Updated by Gerrit Code Review 3 months ago

Patch set 17 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/85632

Actions
Copy link
 #25

Updated by Gerrit Code Review 3 months ago

Patch set 18 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/85632

Actions
Copy link
 #26

Updated by Gerrit Code Review 3 months ago

Patch set 19 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/85632

Actions
Copy link
 #27

Updated by Gerrit Code Review 3 months ago

Patch set 20 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/85632

Actions
Copy link
 #28

Updated by Gerrit Code Review 3 months ago

Patch set 21 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/85632

Actions
Copy link
 #29

Updated by Gerrit Code Review 3 months ago

Patch set 22 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/85632

Actions
Copy link
 #30

Updated by Gerrit Code Review 3 months ago

Patch set 23 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/85632

Actions
Copy link
 #31

Updated by Gerrit Code Review 3 months ago

Patch set 24 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/85632

Actions
Copy link
 #32

Updated by Gerrit Code Review 3 months ago

Patch set 25 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/85632

Actions
Copy link
 #33

Updated by Gerrit Code Review 3 months ago

Patch set 26 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/85632

Actions
Copy link
 #34

Updated by Gerrit Code Review 3 months ago

Patch set 27 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/85632

Actions
Copy link
 #35

Updated by Gerrit Code Review 3 months ago

Patch set 28 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/85632

Actions
Copy link
 #36

Updated by Gerrit Code Review 3 months ago

Patch set 29 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/85632

Actions
Copy link
 #37

Updated by Gerrit Code Review 3 months ago

Patch set 1 for branch 12.4 of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/85809

Actions
Copy link
 #38

Updated by Oliver Hader 3 months ago

  • Status changed from Under Review to Resolved
Actions
Copy link
 #39

Updated by Oliver Hader 3 months ago

  • Related to Task #104633: Combine disabling site-specific CSP with report-only mode added
Actions
Copy link
 #40

Updated by Oliver Hader 3 months ago

  • Related to Feature #101580: Add feature flag to enable CSP ReportOnly mode added
Actions
Copy link
 #41

Updated by Oliver Hader 3 months ago · Edited

Disabling CSP per-site has been re-introduced into TYPO3 v12.

See https://docs.typo3.org/c/typo3/cms-core/main/en-us/Changelog/12.4.x/Important-104549-IntroduceSiteSpecificContentSecurityPolicyDisposition.html#example-disable-content-security-policy

in config/sites/<my-site>/csp.yaml

# `active` is enabled per default if omitted
active: false

Actions
Copy link
 #42

Updated by Benni Mack about 1 month ago

  • Status changed from Resolved to Closed
Actions
Copy link

Also available in: Atom PDF