Allow custom csp header by TheSyscall · Pull Request #5477 · Icinga/icingaweb2

TheSyscall · 2026-03-12T13:02:12Z

Taking over #5337 (#5337 (comment)) and implementing an override for a completely custom CSP-Header.

As well as adding a table below the form which displays the source of the automatically generated CSP-Header.

Styling for this table is still WIP.

requires Icinga/ipl-web#358
requires Icinga/ipl-web#361

closes #5337
closes #5333

bobapple · 2026-03-13T11:09:08Z

@cla-bot check

Al2Klimov

13 review comments should be enough for a Friday 13th. :D

library/Icinga/Web/Response.php

application/forms/Config/General/ApplicationConfigForm.php

Al2Klimov · 2026-03-13T14:36:05Z

application/forms/Config/General/CspConfigForm.php

+        $useCustomCsp = $this->getPopulatedValue('use_custom_csp', 'n') === 'y';
+        if ($useCustomCsp) {
+            $this->addHtml((new Callout(
+                CalloutType::Warning,


Get Introduce Callout ipl-web#358 done before merging this PR

Already listed as a requirement

application/forms/Config/General/CspConfigForm.php

application/controllers/ConfigController.php

library/Icinga/Util/Csp.php

library/Icinga/Web/Widget/CspConfigurationTable.php

TheSyscall · 2026-03-16T11:58:19Z

application/forms/Config/Security/CspConfigForm.php

+use ipl\Web\Compat\CompatForm;
+use ipl\Web\Widget\Callout;
+
+class CspConfigForm extends CompatForm


This currently doesn't output the config.ini to the screen like the old ConfigForm did.
I think changing the form type to a CompatForm is still the right call, because we don't want to rely on Zend_Forms forever.
If this behavior essential, we should reimplement the behavior of ConfigFrom as a CompatForm instead.

Even in new modules we reimplemented this behavior: Icinga/icingadb-web#1269

So I'd not downgrade this functionality.

PR for this is open at #5480

application/forms/Config/Security/CspConfigForm.php

public/css/icinga/widgets.less

application/forms/Config/Security/CspConfigForm.php

Al2Klimov · 2026-03-19T15:44:35Z

library/Icinga/Web/Widget/CspConfigurationTable.php

+        );
+
+        $this->addPolicyTable(
+            t('Dashboard'),


If you're concerned about #5477 (comment), you should be about this one too:

As not a IW2 dev, I'd have absolutely no clue that these are only my dashboards (if any!) and others may have their own.

Consider listing the dashboard-CSPs of all users, after all we have them (by name) in the preference store or something idk.

Module-provided dashboards should already be included as you should see all modules as admin. I guess they may contain external URLs as well.

I'm not sure if we always have access to all users in something like LDAP.
Also listing all dashboards and menu entries for all users in an organization on every initial request seems pretty expensive.

If a module wants something whitelisted beyond what is automatically detected, it can already do that.

We always have access to all users' dashboards and menu entries.

Imagine you make a custom CSP based on the generated one, but latter misses non-your dashboards.

application/forms/Config/General/CspConfigForm.php

application/forms/Config/Security/CspConfigForm.php

application/controllers/ConfigController.php

library/Icinga/Web/Widget/CspConfigurationTable.php

library/Icinga/Util/Csp.php

flourish86 · 2026-03-23T12:38:49Z

So, here would be my recommendation as discussed.

The simplified version

Step 1

Strict CSP ist disabled

Step 2

Enable CSP to see a table of generated CSP dependending on system and module usage.

Step 3

Toggle Custom CSP. This disables the generated CSP

Improvements

Proper hierarchy for the csp elements
Make obvious, what is enabled and disabled with "opacity"
Keep the table visible for reference, even when custom csp overrides the generated table
Add heltexts to clarify how it works

Additionally

Not in the mockups: Add toggles for Dashboard and Navigation section

flourish86 · 2026-03-23T13:10:36Z

Advanced version of the editor

Rows can be toggled separately.

Disabled rows will fade out

Custom CSP sources can be added additionally

Generated CSP can be disabled completely

Only Custom CSP Rules will be used

- Reload of form change if Csp was previously enabled in `ConfigController` - Use default attributes in `CspConfigurationTable` - Rename `$policyDirectives` to `$directivePolicies` in `Csp`

This tab requires the new config/security permission

…nonce

This allows for checkboxes integrated inside the table. This commit also adds disabling modules, dashboards and navigation items individualy.

…fore

TheSyscall requested a review from nilmerg March 12, 2026 13:02

TheSyscall self-assigned this Mar 12, 2026

This comment was marked as duplicate.

Sign in to view

TheSyscall requested a review from Al2Klimov March 12, 2026 13:03

This comment was marked as duplicate.

Sign in to view

TheSyscall mentioned this pull request Mar 12, 2026

Allow editing of the CSP trusted image sources. #5337

Open

Al2Klimov mentioned this pull request Mar 12, 2026

Introduce \Icinga\Application\Hook\Essentials #5474

Open

This comment was marked as resolved.

Sign in to view

cla-bot bot added the cla/signed label Mar 13, 2026

TheSyscall force-pushed the allow-custom-csp-header-5333 branch from 735beb2 to cdef4c4 Compare March 13, 2026 13:18

This comment was marked as resolved.

Sign in to view

TheSyscall requested a review from Al2Klimov March 13, 2026 13:25

Al2Klimov removed the request for review from nilmerg March 13, 2026 14:44

Al2Klimov requested changes Mar 13, 2026

View reviewed changes

TheSyscall commented Mar 16, 2026

View reviewed changes

TheSyscall requested a review from Al2Klimov March 16, 2026 11:59

This comment was marked as resolved.

Sign in to view

Al2Klimov reviewed Mar 18, 2026

View reviewed changes

application/forms/Config/Security/CspConfigForm.php Outdated Show resolved Hide resolved

TheSyscall requested a review from Al2Klimov March 19, 2026 08:58

Al2Klimov requested changes Mar 19, 2026

View reviewed changes

Al2Klimov mentioned this pull request Mar 20, 2026

Implement Webdriver Icinga/icingaweb2-module-pdfexport#88

Open

TheSyscall force-pushed the allow-custom-csp-header-5333 branch from f9f19b4 to 3a4e7ac Compare March 23, 2026 10:21

TheSyscall requested a review from Al2Klimov March 24, 2026 10:59

lippserd added this to the 2.13 milestone Mar 24, 2026

Al2Klimov mentioned this pull request Mar 24, 2026

Implement Csp Icinga/ipl-web#361

Open

TheSyscall added 29 commits April 2, 2026 10:10

Change naming of button to "Send CSP-Header"

c615368

Support custom CSP with empty value

7720360

Color the "data:" schema based on the directive

8a82898

Code style & Move arrays to class constants

60a4ffe

Code review changes

6e84ac5

- Reload of form change if Csp was previously enabled in `ConfigController` - Use default attributes in `CspConfigurationTable` - Rename `$policyDirectives` to `$directivePolicies` in `Csp`

Add a toggle to enable user content

f2ee388

Move CSP-Form into a newly created Security tab.

97377a2

This tab requires the new config/security permission

Code review suggestions

1a60be2

Use new Csp class in ipl-web

1526729

Prefixed CSS-classes with csp-

100dcfe

Code style changes

9aeb8a8

Rework Csp to no longer rely on a private instance just to store the …

e99fa2b

…nonce

Add form validation

650f932

Merge CspConfigurationTable with form

9853a5b

This allows for checkboxes integrated inside the table. This commit also adds disabling modules, dashboards and navigation items individualy.

fixup! Store custom_csp

9a0211e

fixup! Remove large margin-bottom from table

036fdd1

Default use_custom_csp to 0

b9da9f0

Store security seection in config even if the section didn't exist be…

440e8ec

…fore

Log errors during Csp loading

4b06ab8

Return Csp instances instead of raw arrays

a204e9b

Change Hook name to CspPolicyProvider

9401454

Make tables collapsible

d34cf59

Split title from table

7ba3020

Code review changes

55334f2

Indent polices if an icon exists in the table

65a8a19

Return an empty array instead of throwing an error

a3525b0

Change license and use SPDX-Header

7e2f24c

Display the label of the navigation type instead of its internal type

a7a64d6

Write documentation

bfec859

TheSyscall force-pushed the allow-custom-csp-header-5333 branch from 3a24ab1 to bfec859 Compare April 2, 2026 09:32

Conversation

TheSyscall commented Mar 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

This comment was marked as duplicate.

This comment was marked as duplicate.

This comment was marked as duplicate.

This comment was marked as resolved.

This comment was marked as resolved.

Uh oh!

bobapple commented Mar 13, 2026

Uh oh!

This comment was marked as resolved.

Al2Klimov left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Al2Klimov Mar 13, 2026

Choose a reason for hiding this comment

Uh oh!

TheSyscall Mar 16, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

TheSyscall Mar 16, 2026

Choose a reason for hiding this comment

Uh oh!

Al2Klimov Mar 19, 2026

Choose a reason for hiding this comment

Uh oh!

TheSyscall Mar 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

This comment was marked as resolved.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Al2Klimov Mar 19, 2026

Choose a reason for hiding this comment

Uh oh!

TheSyscall Mar 20, 2026

Choose a reason for hiding this comment

Uh oh!

Al2Klimov Mar 20, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

flourish86 commented Mar 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Step 1

Step 2

Step 3

Improvements

Additionally

Uh oh!

flourish86 commented Mar 23, 2026

Rows can be toggled separately.

Disabled rows will fade out

Custom CSP sources can be added additionally

Generated CSP can be disabled completely

Uh oh!

Reviewers

Assignees

Labels

Projects

TheSyscall commented Mar 12, 2026 •

edited

Loading

TheSyscall Mar 25, 2026 •

edited

Loading

flourish86 commented Mar 23, 2026 •

edited

Loading