Content-Security-Policy „default-src 'self';“ and the admin console #11878

esunke · 2022-05-06T18:41:39Z

esunke
May 6, 2022

Hi,
I am using Keycloak 16.1.1 (Bitname docker image). A spart of security checks, we are forced to enable several content security policies. When I enable them, I cannot access the admin console UI any more. I found some discussions that stated that I should use the Keycloak v2 theme So I enabled the admin2 feature and activated the new theme, However, the admin console is still not usable. I get several issues related to the CSP. Is there any way to enable the policies and also use the admin UI?
Thanks, Eik

darius-m · 2022-05-06T21:40:47Z

darius-m
May 6, 2022

The default-src: 'self' policy should instruct the browser to automatically use this policy for any type of resource (e.g., images, javascript, stylesheets) that does not have an explicit policy. 'self' means that all data should be stored on the keycloak server itself.

The admin console probably requires outside dependencies at least for CSS files (it relies on 3rd party frameworks). Without seeing the issues, I will assume that there are some errors with downloading the CSS stylesheets or javascript scripts. From what I understand (I am also interested in input from someone more knowledgeable), you have two options:

host all frameworks on the keycloak servers (this will probably increase the load on the servers unless you also use a caching reverse proxy);
host a CDN server that you trust with the frameworks and change the references used by the themes to your CDNs.

This being said, I do not know how to change how themes are built, or if having no external dependencies is an currently an option.

3 replies

esunke May 7, 2022
Author

Thanks for the reply.
I just checked in more detail.
The issues coming up are mainly based on inline scripts and inline styles.

"Refused to apply inline style" and "Refused to execute inline script".

To be sure I just tested with the 18.0.0 version of keycloak. But still, the directive cannot be used.

Since we are talking about an security relevant part of an architecture, this is something that should be addressed and fixed.

darius-m May 7, 2022

Inline scripts are implicitly blocked by the self policy since it explicitly requires the scripts to be downloaded from the server as separate files. Fixing this in the code would be ideal (I would also prefer it), but impossible depending on how the framework used by the interface generates the pages.

A possible workaround would be adding the unsafe-inline or a nonce value to the script-src, but it may not be acceptable for everyone.

darius-m May 9, 2022

There also seems to be an issue with styling, so similar options should be set for style-src. In this case, I believe separating styling and moving it to other files is harder, since frameworks may prefer adding styles inline with the HTML element. Something like <div style="display: none" to hide elements, for example.

Navigation Menu

Repository navigation

Content-Security-Policy „default-src 'self';“ and the admin console #11878

Uh oh!

{{title}}

Uh oh!

Replies: 1 comment 3 replies

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

Content-Security-Policy „default-src 'self';“ and the admin console #11878

Uh oh!

esunke May 6, 2022

Replies: 1 comment · 3 replies

Uh oh!

darius-m May 6, 2022

Uh oh!

esunke May 7, 2022 Author

Uh oh!

darius-m May 7, 2022

Uh oh!

darius-m May 9, 2022

esunke
May 6, 2022

Replies: 1 comment 3 replies

darius-m
May 6, 2022

esunke May 7, 2022
Author