The issues from brucejo75

Digital Ocean eliminates `content-security-policy` settings from caddy if they contain a newline

I set Content-Security-Policies in my caddy file. But when I fetch the page using curl the setting are not in the page. This works fine on my dev machine, this only occurs on the Digitial Ocean Droplet.

Here is the test I performed:

create a very simple Caddyfile for testing:

stg.merisapp.com,
:2015 {
  header {
    Access-Control-Allow-Origin https://{hostport}/
    Service-Worker-Allowed "./"
    Strict-Transport-Security "max-age=31536000; includeSubDomains"
    Permissions-Policy `geolocation=(self)`
    content-security-policy `default-src 'self' https://*.unpkg.com;
 connect-src 'self' static.cloudflareinsights.com wss: ws: https://*.unpkg.com;`
  }

  respond "stg.merisapp.com response"
  log
}

I get the expected parameters when I curl with the localhost target; curl -I -H "Host: stg.merisapp.com" http:/localhost:2015

target localhost:2015

# retrieve from the localhost port
$ curl -I -H "Host: stg.merisapp.com" http://localhost:2015
HTTP/1.1 200 OK
Access-Control-Allow-Origin: https://stg.merisapp.com/
Content-Security-Policy: default-src 'self' https://*.unpkg.com;  connect-src 'self' static.cloudflareinsights.com wss: ws: https://*.unpkg.com;
Content-Type: text/plain; charset=utf-8
Permissions-Policy: geolocation=(self)
Server: Caddy
Service-Worker-Allowed: ./
Strict-Transport-Security: max-age=31536000; includeSubDomains
Date: Tue, 27 Dec 2022 15:25:39 GMT
Content-Length: 25

I get all the header settings except for the csp settings, when I request from the server curl -I https://stg.merisapp.com --resolve stg.merisapp.com:443:68.183.31.160

target localhost:443

# retrieve from the digital ocean IP address
$ curl -I https://stg.merisapp.com --resolve 'stg.merisapp.com:443:localhost'
HTTP/2 200
access-control-allow-origin: https://stg.merisapp.com/
alt-svc: h3=":443"; ma=2592000
content-type: text/plain; charset=utf-8
permissions-policy: geolocation=(self)
server: Caddy
service-worker-allowed: ./
strict-transport-security: max-age=31536000; includeSubDomains
content-length: 25
date: Tue, 27 Dec 2022 15:39:54 GMT

Notes:

missing Content-Security-Policy
all header items are converted to lowercase

Caddy thinks it is outputting the csp parameters for every call, from the logs:

Dec 27 15:34:22 merisappstg caddy[650]: {"level":"info","ts":1672155262.0254505,"logger":"http.log.access.log0","msg":"handled request","request":{"remote_ip":"::1","remote_port":"46094","proto":"HTTP/1.1","method":"HEAD","host":"stg.merisapp.com","uri":"/","headers":{"User-Agent":["curl/7.68.0"],"Accept":["*/*"]}},"user_id":"","duration":0.000083723,"size":25,"status":200,"resp_headers":{"Server":["Caddy"],"Content-Security-Policy":["default-src 'self' https://*.unpkg.com;\n connect-src 'self' static.cloudflareinsights.com wss: ws: https://*.unpkg.com;"],"Permissions-Policy":["geolocation=(self)"],"Service-Worker-Allowed":["./"],"Strict-Transport-Security":["max-age=31536000; includeSubDomains"],"Access-Control-Allow-Origin":["https://stg.merisapp.com/"],"Content-Type":["text/plain; charset=utf-8"]}}
Dec 27 15:34:31 merisappstg caddy[650]: {"level":"info","ts":1672155271.103646,"logger":"http.log.access.log0","msg":"handled request","request":{"remote_ip":"162.158.62.107","remote_port":"16638","proto":"HTTP/2.0","method":"GET","host":"stg.merisapp.com","uri":"/","headers":{"X-Forwarded-Proto":["https"],"User-Agent":["curl/7.68.0"],"Cf-Connecting-Ip":["2604:a880:400:d0::1a05:b001"],"Accept-Encoding":["gzip"],"Cf-Ray":["78031eec1a941795-EWR"],"X-Forwarded-For":["2604:a880:400:d0::1a05:b001"],"Cf-Visitor":["{\"scheme\":\"https\"}"],"Accept":["*/*"],"Cf-Ipcountry":["US"],"Cdn-Loop":["cloudflare"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"h2","server_name":"stg.merisapp.com"}},"user_id":"","duration":0.000438492,"size":25,"status":200,"resp_headers":{"Service-Worker-Allowed":["./"],"Strict-Transport-Security":["max-age=31536000; includeSubDomains"],"Access-Control-Allow-Origin":["https://stg.merisapp.com/"],"Content-Security-Policy":["default-src 'self' https://*.unpkg.com;\n connect-src 'self' static.cloudflareinsights.com wss: ws: https://*.unpkg.com;"],"Permissions-Policy":["geolocation=(self)"],"Content-Type":["text/plain; charset=utf-8"],"Server":["Caddy"],"Alt-Svc":["h3=\":443\"; ma=2592000"]}}

I tried this exact same test on my home machine and the csp settings always come through, even when I hit port :443

It seems that Digital Ocean is filtering these parameters if they are not strictly on one line? Is that true?

Note: removing newlines from the caddy file will then allow the csp policies through

Thanks for any help.

brucejo75 / issues Goto Github PK

issues's People

Contributors

Watchers

issues's Issues

Digital Ocean eliminates `content-security-policy` settings from caddy if they contain a newline

Recommend Projects

React

Vue.js

Typescript

TensorFlow

Django

Laravel

D3

Recommend Topics

javascript

web

server

Machine learning

Visualization

Game

Recommend Org

Facebook

Microsoft

Google

Alibaba

D3

Tencent