Content-security-policy: angular and spring boot application on Prod mode

user_3413286 0
Viewed 3144

I am working on a spring boot application with an Angular app as a front application. From the back, I send the CSP policy as the above

.and()
            .headers()
            .contentSecurityPolicy(default-src 'self'; frame-src 'self'; script-src 'self' 'unsafe-inline' https://storage.googleapis.com; style-src 'self' 'unsafe-inline'; img-src 'self'; font-src 'self' object-src; require-trusted-types-for 'script')

When I run the application on dev, and I changed the CSP policy, I get errors on the console of the Angular front which is a normal thing. When I run the application on prod, even I change the CSP policy with

default-src 'self'

the application continues to function which is strange.

So my questions are:

  1. Where the Angular gets the CSP policy on the code?
  2. On prod mode, Can we have a CSP policy?

PS: I am using Angular version 8.2.4

content-security-policy angular spring-boot
1 Answers

Where the Angular gets the CSP policy on the code?

The right answer is - no were. Angular code does no nothing (and should not know) about Content-Security-Policy header. CSP header is an instruction for the browser what resources and where it can take.

Simple example:

Content-Security-Policy: default-src https:

When the browser will see this directive it will refuse to load anything from HTTP. If you are trying to get your scripts from HTTP, angular will not even start, because of no script available.

On prod mode, Can we have a CSP policy?

Yes. CSP is a very useful tool that greatly increases the security of your application. So, if you care about your customer, CSP (and feature policy as well) should be taken into consideration.

But settings things up is quite time-consuming. I spent a day or two to find the best combination for myself.

Try this one (don't forget to adjust with google.api):

default-src 'none'; img-src 'self' data:; font-src 'self'; connect-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; object-src 'none'

Hope this helps!

upd

Here you can find more about CSP (and written in better way)

user_55755950
Related