Uploaded image for project: 'Jira Software Server and Data Center'
  1. Jira Software Server and Data Center
  2. JSWSERVER-19912

Implement Configuration Option for CSP Header

    XMLWordPrintable

    Details

    • Type: Suggestion
    • Status: Gathering Interest (View Workflow)
    • Resolution: Unresolved
    • Affects Version/s: None
    • Fix Version/s: None
    • Component/s: None
    • Labels:
      None
    • Feedback Policy:
      We collect Jira feedback from various sources, and we evaluate what we've collected when planning our product roadmap. To understand how this piece of feedback will be reviewed, see An updated workflow for server feature suggestions.

      Description

      Definition

      Currently, there's no way to modify the content-security-policy header besides:

      However, there is no way to provide a different configuration for that header. For example a user may prefer to have:

      frame-ancestors 'self' https://trusteddomain.com

      This will allow users to exempt applink URLs for instance from these checks as trusted domains. Useful for embedding gadgets, pages etc from one Atlassian Application to the other.

      Suggestion

      Provide more configuration options for this header. Atleast provide a way to specify trusted domains from where the Jira web page can be framed.

      Workaround

      Use a web-server like Apache, Nginx etc as a reverse proxy and then use the header re-write features of the proxy to add these headers.

        Attachments

          Issue Links

            Activity

              People

              • Assignee:
                Unassigned
                Reporter:
                acardino Anna Cardino
              • Votes:
                4 Vote for this issue
                Watchers:
                3 Start watching this issue

                Dates

                • Created:
                  Updated: