Content-Security-Policy Ckeditor

user_14552598 0
Viewed 1236

Hello everybody thanks for reading. I have a problem with Ckeditor, Now i use Content-Security-Policy and editor do not show buttons like the image if i delete this line

Header always set Content-Security-Policy: "style-src 'self' www.site.com; child-src https://www.youtube.com"

work good now what can i do , do you have a idea? Please help me, thanks a lot.

enter image description here

content-security-policy ckeditor
3 Answers

To publish CSP via the Header always set Content-Security-Policy:... is not good idea.

  1. Such CSP header will be sent with any content: .js, .css, .jpeg and word always means that it will be send not only with pages having '200 OK' status, but for Error / Redirect / Not Modified / etc.
  2. You have no flexibility to manage such header. If your web page will publish own Content-Security-Policy header, for example via PHP header("Content-Security-Policy: default-src 'self';", you will have 2 glued CSP headers with unpredictable consequences.

In your case - you do not need to publish CSP header in the admin panel (where you do use Ckeditor). But due to para 2 of above, you have the CSP header everywhere and have no possibility to switch it off.

Mush better to use some plugins for your CMS for CSP header management. Such plugins smart enough and do not publush CSP in the admin panel and for error/redirect pages.
If you do not use CMS, you can publish CSP, for example via header() PHP function in appropriate index.php (since you use Ahache web server).

PS: If you do use CKeditor in the site (non in the admin) - you need to expand your CSP rules to allow CKeditor scripts and styles.

UPDATE
Judging by the comments, webmasters are having difficulties with CSP for CKEditor, but no one said which version: 4 or 5.

  1. Content Security Policy for Ckeditor-4 if it's loaded from cdn.ckeditor.com CDN:

connect-src https://pdf-converter.cke-cs.com;
form-action 'self';
img-src cdn.ckeditor.com;
script-src 'unsafe-inline' cdn.ckeditor.com;
style-src 'unsafe-inline' cdn.ckeditor.com;

* SKE-4 is incompatible with 'nonce-value' and requires mandatory 'unsafe-inline' because a lot of inline scripts.

  1. Content Security Policy for Ckeditor-5 if it's loaded from cdn.ckeditor.com CDN:

connect-src https://docx-converter.cke-cs.com https://pdf-converter.cke-cs.com;
form-action 'self';
script-src 'unsafe-inline' https://cdn.ckeditor.com/ckeditor5/;
style-src 'unsafe-inline';

* SKE-5 scripts are compatible with 'nonce-value' so you can get rid of 'unsafe-inline' in script-src.

  1. Content Security Policy for Ckeditor-5 if it's loaded from server where site is placed:

connect-src https://docx-converter.cke-cs.com https://pdf-converter.cke-cs.com;
form-action 'self';
script-src 'self' 'unsafe-inline';
style-src 'unsafe-inline';

PS: The connect-src https://docx-converter.cke-cs.com https://pdf-converter.cke-cs.com; is required only if "Export to PDF" and "Export to Word" buttons are used.

user_128659440

if use nonce, I do like this

    (function(cke) {

        var _owrite = cke.dom.document.prototype.write;
        cke.dom.document.prototype.write = function(src) {
            src = src.replace(/<script/gmi, '<script nonce="' + nonceValue + '"');
            _owrite.apply(this, [src]);
        };

    })(CKEDITOR);
user_48532500

A simple solution i used in my project after several fail trials to whitelist Ckeditor, is to exclude CSP urls prefixes that going to use rich text editor.

In my case it was the product admin page.

user_133436950
Related