Allow custom csp header by TheSyscall · Pull Request #5477 · Icinga/icingaweb2

TheSyscall · 2026-03-12T13:02:12Z

Taking over #5337 (#5337 (comment)) and implementing an override for a completely custom CSP-Header.

As well as adding a table below the form which displays the source of the automatically generated CSP-Header.

Styling for this table is still WIP.

requires Icinga/ipl-web#358

closes #5337
closes #5333

…c scp header

Co-authored-by: Davide Zeni <davidezeni02@gmail.com>

…avigation items

This commit also adds headers to the general config section

TheSyscall · 2026-03-16T11:58:19Z

application/forms/Config/General/CspConfigForm.php

+use ipl\Web\Compat\CompatForm;
+use ipl\Web\Widget\Callout;
+
+class CspConfigForm extends CompatForm


This currently doesn't output the config.ini to the screen like the old ConfigForm did.
I think changing the form type to a CompatForm is still the right call, because we don't want to rely on Zend_Forms forever.
If this behavior essential, we should reimplement the behavior of ConfigFrom as a CompatForm instead.

Even in new modules we reimplemented this behavior: Icinga/icingadb-web#1269

So I'd not downgrade this functionality.

Al2Klimov

16 review comments should be enough for a Monday 16th. :)

application/forms/Config/General/CspConfigForm.php

Al2Klimov · 2026-03-16T13:56:50Z

application/forms/Config/General/CspConfigForm.php

+use ipl\Web\Compat\CompatForm;
+use ipl\Web\Widget\Callout;
+
+class CspConfigForm extends CompatForm


What about always showing the generated CSP? Even if they're not in effect, they're a good cheat sheet, especially for a custom CSP.

I'm personally not a fan of that, because it might confuse people about what is currently active and that isn't.
I think waiting for @flourish86 to design something and talking about that with @lippserd is the right call here.

application/forms/Config/General/CspConfigForm.php

library/Icinga/Util/Csp.php

Al2Klimov · 2026-03-16T15:37:55Z

library/Icinga/Util/Csp.php

+                        'frame-src' => [$absoluteUrl],
+                    ],
+                    'reason' => [
+                        'type'    => 'dashlet',


The longer I look at this code, the more I'd like it to use classes (LoginButton #5442) end enums (CalloutType #358).

Colleagues who read this, let me know your opinions on this!

Yes. I agree, that was my first idea as well, but then I didn't want to introduce classes that are exclusively used inside the Csp-System.

PS: I think you wanted to link Icinga/ipl-web#358

library/Icinga/Util/Csp.php

application/controllers/ConfigController.php

application/forms/Config/General/CspConfigForm.php

This makes it compatible with previous versions.

This commit also adds parsing to the policies. Turning urls into clickable links, and coloring potentially dangerous policies orange.

Al2Klimov · 2026-03-18T15:38:38Z

application/forms/Config/General/CspConfigForm.php

+        $section['use_strict_csp'] = $this->getValue('use_strict_csp');
+        if ($this->isCspEnabled()) {
+            $section['use_custom_csp'] = $this->getValue('use_custom_csp');
+            if ($this->isCustomCspEnabled()) {


We have three states here:

No CSP

Generated CSP

Custom CSP

Ideal use case for a dropdown.

@flourish86 What do you think?

(I.e use_strict_csp would keep values "0" and "1" internally for compatibility and add "custom".)

A dropdown would be the easiest choice here. That is a common pattern for forms in icingaweb. I personally like the two "nested" checkboxes, because it makes it clearer what you are doing in a techncal level.

Al2Klimov · 2026-03-19T15:23:35Z

public/css/icinga/widgets.less

 html.no-js .progress-label {
  display: none;
 }
-


What's this change for?

Al2Klimov · 2026-03-19T15:29:06Z

application/forms/Config/General/CspConfigForm.php

+use ipl\Web\Compat\CompatForm;
+use ipl\Web\Widget\Callout;
+
+class CspConfigForm extends CompatForm


Consider a toggle which appears along with generated CSP which controls whether to include user-entered stuff, such as dashlets, in the CSP.

Al2Klimov · 2026-03-19T15:44:35Z

library/Icinga/Web/Widget/CspConfigurationTable.php

+        );
+
+        $this->addPolicyTable(
+            t('Dashboard'),


If you're concerned about #5477 (comment), you should be about this one too:

As not a IW2 dev, I'd have absolutely no clue that these are only my dashboards (if any!) and others may have their own.

Consider listing the dashboard-CSPs of all users, after all we have them (by name) in the preference store or something idk.

Module-provided dashboards should already be included as you should see all modules as admin. I guess they may contain external URLs as well.

Al2Klimov · 2026-03-19T15:50:55Z

application/forms/Config/General/CspConfigForm.php

+                        'class'               => 'collapsible',
+                        'data-visible-height' => 250,
+                    ],
+                    new CspConfigurationTable(),


With the table, this form is already large enough to have its own IW2 configuration tab.

While on it, Implement password policy with hook #5419 could also go there.

CC @JolienTrog

Al2Klimov · 2026-03-19T15:57:31Z

application/forms/Config/General/CspConfigForm.php

+                    ),
+                    'class'          => 'autosubmit',
+                    'checkedValue'   => '1',
+                    'uncheckedValue' => '0',


New form elements don't need these, do they?

Al2Klimov · 2026-03-19T16:06:01Z

application/controllers/ConfigController.php

+        ]);
+
+        $cspForm->on(ContractForm::ON_SUBMIT, function (CspConfigForm $form) use ($config) {
+            if ($form->isCspEnabled() && $form->hasConfigChanged()) {


What if I disable the CSP? Don't I deserve a reload?

Al2Klimov · 2026-03-19T16:10:11Z

library/Icinga/Web/Widget/CspConfigurationTable.php

+
+    public function __construct()
+    {
+        $this->getAttributes()->add('class', 'csp-config-table');


I wonder if BaseHtmlElement#defaultAttributes can be used instead.

Al2Klimov · 2026-03-19T16:14:15Z

library/Icinga/Web/Widget/CspConfigurationTable.php

+                return Table::tr([
+                    Table::td($reason['navType']),
+                    Table::td($reason['name']),
+                    Table::td($reason['parent'] ?? 'NA'),


'NA' misses translation.

Al2Klimov · 2026-03-19T16:20:41Z

library/Icinga/Web/Widget/CspConfigurationTable.php

+        if ($policy === '*') {
+            $result = HtmlElement::create('span', ['class' => 'wildcard'], $policy);
+        } elseif ($policy === "'self'") {
+            $result = HtmlElement::create('span', ['class' => 'self'], $policy);


@flourish86 I wonder if such generic names for CSS classes could clash with new ones in the future.

Al2Klimov · 2026-03-19T16:23:59Z

library/Icinga/Util/Csp.php

+            }
+        }
+
+        unset($policyDirectives);


What's this for?

w1ll-i-code and others added 17 commits March 12, 2026 12:55

Allow modules to adjust the CSP headers through a dedicated hook.

a9f393a

Add additional validation for the url before using it in the frame-sr…

1d8ca8a

…c scp header

Allow editing of the CSP trusted image sources

535247e

Co-authored-by: Davide Zeni <davidezeni02@gmail.com>

Refactor CSP validation logic and improve access control for shared n…

ff9ad78

…avigation items

Refactor CSP handling to improve user checks

13304d5

Add a table which displays where a CSP directive comes from

dcb8ca9

Move CSP table into its own Widget

e9861c8

This commit also adds headers to the general config section

Integrate the custom CSP setting

4f1cdc0

Use new hook style

b939340

Custom CSP should completely override the automatically generated one

a5c5070

Allow configuration of the custom CSP-Header

9b0f81e

Move the check to send the CSP header into the Csp::isCspEnabled method

23892a1

Fix a bug that caused the custom CSP textarea to be empty

edfd71c

Allow for the usage of {style_nonce} in the custom CSP-Header setting

0868d67

Allow newlines in custom CSP

a84d7d4

Fix a bug that caused the custom_csp value to not be saved

9247ccf

Add dynamic descryption for the custom CSP textarea

9246ff1

TheSyscall requested a review from nilmerg March 12, 2026 13:02

TheSyscall self-assigned this Mar 12, 2026

This comment was marked as duplicate.

Sign in to view

TheSyscall requested a review from Al2Klimov March 12, 2026 13:03

Fix code formating

2011d69

This comment was marked as duplicate.

Sign in to view

fixup! Fix code formating

222e898

This comment was marked as duplicate.

Sign in to view

TheSyscall mentioned this pull request Mar 12, 2026

Allow editing of the CSP trusted image sources. #5337

Open

Al2Klimov mentioned this pull request Mar 12, 2026

Introduce \Icinga\Application\Hook\Essentials #5474

Open

TheSyscall added 3 commits March 12, 2026 16:09

Use generator to iterate the navigation items

4ed01ed

fixup! hasAccessToSharedNavigationItem doesn't need to be public

484b565

Add info for navigation items

0e35feb

TheSyscall added 6 commits March 16, 2026 09:55

Change URLs in method documentation CspDirectiveHook::getCspDirectives()

67bbdb2

Use getValue instead of getPopulatedValue

b83938e

Handle update to new value gracefully

815f1a5

Use a hidden element with the same name to store the custom value

99607e1

Remove superfluous mentions of CSP inside the Csp class

406d18d

Use constructor promotion

17a9fe6

TheSyscall commented Mar 16, 2026

View reviewed changes

TheSyscall requested a review from Al2Klimov March 16, 2026 11:59

Al2Klimov requested changes Mar 16, 2026

View reviewed changes

TheSyscall added 15 commits March 17, 2026 07:16

Remove duplicate default-src directive

639098f

Store populated values in hidden form elements

325eb68

Only store and reload page if necessary

dd06793

Navigation items that have children can also link to something

b64fe38

Include the port in the navigation URL

aa7ee0f

Navigation items on the top level should not have themselves as a parent

4257783

Use 0/1 instead of n/y for config values

2a7c350

This makes it compatible with previous versions.

Removed unnecessary call to getUsername

39f59bb

Use generator to return the collection of CSP-Directives

8cd63b3

Split CSP-Table into multiple with apropriate headers.

50fe2b1

This commit also adds parsing to the policies. Turning urls into clickable links, and coloring potentially dangerous policies orange.

Hide tables with no content

0c10a32

Use Link widget

3876258

Move table into form

28137c4

fixup! Move CSP table into its own Widget

1c1041e

Change naming of button to "Send CSP-Header"

dc5e58d

Al2Klimov reviewed Mar 18, 2026

View reviewed changes

TheSyscall added 3 commits March 19, 2026 07:44

Support custom CSP with empty value

2d6592f

Color the "data:" schema based on the directive

79ef3af

Code style & Move arrays to class constants

c928a2c

TheSyscall requested a review from Al2Klimov March 19, 2026 08:58

Al2Klimov requested changes Mar 19, 2026

View reviewed changes

Conversation

TheSyscall commented Mar 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

This comment was marked as duplicate.

This comment was marked as duplicate.

This comment was marked as duplicate.

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Al2Klimov left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

TheSyscall Mar 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

TheSyscall commented Mar 12, 2026 •

edited

Loading

TheSyscall Mar 17, 2026 •

edited

Loading