duplicated CSP frame-ancestors policy

[wkloucek]

Describe the bug

On the root path of oCIS, we get two content-security-policy headers. One has a static frame-ancestors 'self' config

Steps to reproduce

1. run oCIS 6.3.0 eg. in Kubernetes using the development-install deployment example
2. open oCIS, eg https://ocis.kube.owncloud.test/ after opening the network console
3. Look at the request to https://ocis.kube.owncloud.test/

Expected behavior

Have one header content-security-policy reflecting my oCIS csp configuration.

Actual behavior

Further context

The second header seems to be statically set to frame-ancestors 'self' and always there, even if I have a more sophisticated CSP config

[wkloucek]

This additional header probably originates here:

ocis/services/web/pkg/middleware/silentrefresh.go

Lines 7 to 13 in a7a10f8

	// SilentRefresh allows the oidc client lib to silently refresh the token in an iframe
	func SilentRefresh(next http.Handler) http.Handler {
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
	w.Header().Set("Content-Security-Policy", "frame-ancestors 'self'")
	next.ServeHTTP(w, r)
	})
	}

[wkloucek]

And what it actually does: it takes precedence over the frame-ancestors policy in the first header...

[micbar]

@kulmann @JammingBen

Escalating it to P2

[jvillafanez]

As far as I know, the CSP is fully handled by the proxy service (through the csp.yaml file), and no other service should try to set the CSP. The easiest solution is to remove that header from the web service and let the proxy service to handle it; we might need to document that the frame-ancestor 'self' (or a more relaxed) policy is required.

Alternatively, we could implement a way for any service to overwrite the CSP in the proxy service. In this case, the web service would require the proxy service to set, at least, the frame-ancestor 'self' policy. However, the solution seems complex and will require proper design. Note that setting the policy might be critical (service might not work properly if the policy isn't set), and we need to deal with communication errors between the services.

[micbar]

The easiest solution is to remove that header from the web service and let the proxy service to handle it;

Yes. That should do it for now.

[jvillafanez]

#10146 should fix the double CSP header.

[jvillafanez]

PR merged. Closing.