diff --git a/doc/settings/configuration.md b/doc/settings/configuration.md index d6af4c2d3c803aa2132003175902ad2197f1f5a6_ZG9jL3NldHRpbmdzL2NvbmZpZ3VyYXRpb24ubWQ=..ffa662afe72551d29c3f03663ea3b868be0d8935_ZG9jL3NldHRpbmdzL2NvbmZpZ3VyYXRpb24ubWQ= 100644 --- a/doc/settings/configuration.md +++ b/doc/settings/configuration.md @@ -614,5 +614,16 @@ ```ruby gitlab_rails['content_security_policy'] = { enabled: true, + report_only: false + } + ``` + + GitLab automatically provides secure default values for the CSP. + + To add a custom CSP: + + ```ruby + gitlab_rails['content_security_policy'] = { + enabled: true, report_only: false, directives: { @@ -617,12 +628,8 @@ report_only: false, directives: { - default_src: "'self'", - script_src: "'self' 'unsafe-inline' 'unsafe-eval' https://www.recaptcha.net https://apis.google.com", - frame_ancestors: "'self'", - frame_src: "'self' https://www.recaptcha.net/ https://content.googleapis.com https://content-compute.googleapis.com https://content-cloudbilling.googleapis.com https://content-cloudresourcemanager.googleapis.com", - img_src: "* data: blob:", - style_src: "'self' 'unsafe-inline'" + default_src: "'none'", + script_src: "https://example.com" } } ``` @@ -625,8 +632,11 @@ } } ``` - The previous example is a configuration that works for most GitLab installations. + [In GitLab 14.9 and later](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/80303), secure default values + are used for the directives that aren't explicitly configured. + + To unset a CSP directive, set a value of `false`. 1. Reconfigure GitLab: