0

I have an Alfresco 5.2 Community edition and I'm testing it's security using the OWASP ZAP tool (version 2.11.1). Alfresco runs behind a nginx reverse proxy which applies the HTTPS certificate.

Scanning my Alfresco I receive some warnings about "Content Security Policy (CSP) Header Not Set", and, as expected, the Content-Security-Policy is not present on the http header. The warnings are found in the following URLs:

Why Alfresco does not set this header by default? Do have I to configure something on the application?

Checking online they suggest me to modify my nginx config files and add that header. I've tried some options:

If I use add_header Content-Security-Policy "default-src 'self' https://myAlfresco.it;" always; the share page will stop loading correctly.

If I use the most permissive one, the Alfresco works but ZAP tells me the vulnerability is still present. add_header Content-Security-Policy "default-src self https://myAlfresco.it 'unsafe-eval' 'unsafe-inline';" always;

I've tried several mixed configs, but either the platform stops working or the vulnerability is still present. Do you have any suggestion, do I miss something?

Thanks

Jason Aller
  • 3,541
  • 28
  • 38
  • 38
Fjordo
  • 768
  • 3
  • 18
  • 40
  • Apply your strict rule and check the web console what script do not loads, and allow them – IamK Oct 11 '22 at 07:09
  • yes, I've done that. It requires (list not complete) script-src 'unsafe-inline' and 'unsafe-eval'. But ZAP complains about that configuration. It looks like Alfresco need to be quite permissive on the CSP, but then I receive the security vulnerabilities. Could it be? – Fjordo Oct 11 '22 at 07:55
  • You can allow inline scripts with hash (sha256) `script-src 'sha256-yourhashvalue'`; https://content-security-policy.com/hash/ – IamK Oct 11 '22 at 07:58
  • Yes i know, but I'm afraid that is not a viable solution. It is the framework itself who load those inline scripts, I do not control them, don't know how many they are and need to compute their hashes manually. Am I right? – Fjordo Oct 11 '22 at 08:01
  • Yes, you have to do them manually, – IamK Oct 11 '22 at 08:04

0 Answers0