Setting up Content-Security-Policy for Atlassian products
Asked by tdeleeuw:

Hi

I have been looking for the right setting of CSP (Content-Security-Policy). I couldn't find it so I first tried with

Content-Security-Policy "default-src 'self';

but then my pages were not rendered correctly aymore.

It seems to be workling now with the following setting:

Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data:";

Can anyone confirm this is the expected settings? Can I remove the unsafe-eval from the script?

Thanks


Answers:
author: Tero Laihia
body: I'd love some recommendation for this also.

I've been testing CSP lately in our test environment (confluence 6.4.3, jira 7.4.0, apache 2.4.18 proxy), and so far it seems the only way to get it working is to define almost all CSP flags (thanks to <https://content-security-policy.com>, it has good description of those).

Here's example from one of our subdomain's virtual host config:

```
Header set Content-Security-Policy " \
 default-src 'self' *.mydomain.com; \
 script-src 'self' *.mydomain.com 'unsafe-inline' 'unsafe-eval'; \
 style-src 'self' *.mydomain.com 'unsafe-inline'; \
 img-src 'self' *.mydomain.com data:; \
 connect-src 'self' *.mydomain.com; \
 font-src 'self' *.mydomain.com; \
 object-src 'self' *.mydomain.com; \
 media-src 'self' *.mydomain.com; \
 frame-src 'self' *.mydomain.com; \
 child-src 'self' *.mydomain.com; \
 form-action 'self' *.mydomain.com; \
 "
```

We are using wildcard subdomain in CSP, this seems to allow our two subdomains (jira and confluence) to talk to each other.

We are still getting some errors from jira and confluence admin pages, because both local server instances are trying to load js file from jira.atlassian.com, which is now blocked by CSP. Whether thats fatal or not is still under investigation.

comments: author: tdeleeuw
body: Hi

Thanks for you answer. I do not have the subdomain issue as I have mydomain.com/jira and mydomain.com/confluence ;-)

The JS content retrieved from Atlassian should probably be reported as a bug to Atlassian. Imagine one day they have a technical issue, then your "on-premises" instance can also be affected, or worse, if they get hacked, hackers could then inject anything they want straight into your admin console ;-(

If you do raise a bug, provide me the reference I will vote for it ;-)

Thanks

Thierry


author: Sascha Ziemann
body: Did you managed to write a working CPS header?


author: AnnWorley
body: [@Tero Laihia](/t5/user/viewprofilepage/user-id/281824) I got a response from the security team regarding an official recommendation for CSP settings. They let me know that  
we do not have a recommendation for CSP settings for our products and that adding in these headers can cause problems with functionality. While you may find a setting that works for a given product version, future updates may break that policy.

Based on this, it sounds like trial and error is the only way to find out what will work in your environment. If your team uses Content Security Policy headers, it makes it more important than ever to test any upgrades on a test system before upgrading Production applications.  

comments: author: Sascha Ziemann
body: So it is impossible for a confluence server to reach an A grade on <https://observatory.mozilla.org>

This is beyond the pale.


author: Tomasz Kustrzynski
body: Disappointing if this is still the case (still looking for documentation on this). Looks like low hanging fruit for Marketplace Security Bug Bounty Program researchers.


author: Tomasz Kustrzynski
body: Actually I managed to get A+, but had to leave "unsafe-inline" for styles, as all.js includes some :(

These results may not be possible with some types of apps I guess

![Screenshot 2020-10-22 at 09.22.07.png](https://community.atlassian.com/t5/image/serverpage/image-id/115262iC7A45B62AC74B73B/image-size/large?v=v2&px=999 "Screenshot 2020-10-22 at 09.22.07.png")


author: Tilman Bender
body: [@Tomasz Kustrzynski](/t5/user/viewprofilepage/user-id/3521261) Could you share an anonymized version of the CSP that lead to that analysis?


author: Luca Andreatta
body: If I don't set unsafe-inline for script-src, dashboards are not loaded correctly.

[@Tomasz Kustrzynski](/t5/user/viewprofilepage/user-id/3521261) could you tell me how do you configured it?

I used Tero Laihia CSP configuration, although observatory.mozilla.org tells me that it is not so secure.

Do you have any other configurations to use?


author: Luca Andreatta
body: Hi all,

this is how I configured for CSP in Apache:

```
Header set Content-Security-Policy " \
default-src 'self' *.mydomain.com; \
script-src 'self' *.mydomain.com marketplace.atlassian.com 'unsafe-inline' 'unsafe-eval'; \
style-src 'self' *.mydomain.com 'unsafe-inline'; \
img-src 'self' *.mydomain.com *.atlassian.com data:; \
connect-src 'self' *.mydomain.com marketplace.atlassian.com; \
font-src 'self' *.mydomain.com; \
object-src 'self' *.mydomain.com; \
media-src 'self' *.mydomain.com; \
frame-src 'self' *.mydomain.com; \
frame-ancestors 'self' *.mydomain.com; \
child-src 'self' *.mydomain.com; \
form-action 'self' *.mydomain.com; \
base-uri 'self' *.mydomain.com; \
"
```


author: AnnWorley
body: CSPs are usually set at the reverse proxy in front of a webserver. It sounds like you are using Apache? Our doc doesn't have a recommendation for that setting: [Proxying Atlassian server applications with Apache HTTP Server (mod_proxy_http)](https://confluence.atlassian.com/kb/proxying-atlassian-server-applications-with-apache-http-server-mod_proxy_http-806032611.html)

CSP recommendations for several proxies, including Apache, are in this third party doc I found: [Secure your website with Content Security Policy](https://ole.michelsen.dk/blog/secure-your-website-with-content-security-policy.html)

I am not sure what the unsafe-eval is or which script it is in. Please let me know more about this question, I will be happy to research it.

comments: author: tdeleeuw
body: Hi

Thanks for your answer.

I indeed set the headers at the reverse proxy (NGINX in my case).

Obviously the most secure approach is to use only scripts in external files (as it should be harder to create a file, than inject content in a web page).

The eval method is used to execute the javaScript that is in a String. It is sometimes used to "parse" a JSON String to a JavaScript object. The issue is that if the reply contains actual JavaScript, it will be executed.

So if you want to reduce risk of JavaScript based attacks, it is safer to have all your javaScript in static files.

Best regards

Thierry


author: AnnWorley
body: I am asking our security team about this, but most of them are in a different time zone, so it's slow going.

In the meantime, are the links in Branden's answer to the following question of help? [Setting up Content Security Policy in JIRA](https://community.atlassian.com/t5/Jira-Software-questions/Setting-up-Content-Security-Policy-in-JIRA/qaq-p/611056)


author: tdeleeuw
body: Thanks Ann, I have setup the Content Security Policy. it is mostly working, but I would like to know if it can be tighten.

Have a great (sunny) day in AU ;-)

Regards from cold Belgium ;-)


author: AnnWorley
body: Please let me know as specifically as possible what I should ask our security team to help you tighten it. That will help us get a better answer.

I am in Austin, TX! The security folks are in Sydney.

I would be happy to lend you some of our sunny weather. :)


author: Tero Laihia
body: Those links in Branden's answers refer to obsolete X-Frame-Options, CSP's are replacing them. And X-Frame-Options dont support wildcard domains on rules.

So any "official" guide to CSPs would be nice to have.


Tags: bitbucket

jira

security