Problem/Motivation
Content Security Policy is a browser feature that helps prevent XSS and other attacks by sending a header that informs the browser of trusted sources for page resources.
In modern browsers, it replaces the use of X-Frame-Options with the directive frame-ancestors.
Additional directives such as default-src, script-src, and style-src may be difficult to provide default a value in core such as 'self' because it will block third-party or inline resources that site builders expect to load.
For CSP spec see:
- http://www.w3.org/TR/CSP/
- https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Securi...
- https://www.owasp.org/index.php/Clickjacking_Defense_Cheat_Sheet
The contrib modules Content-Security-Policy and Security Kit provide a user interface for configuring a site's Content Security Policy headers, but core should provide a reasonable default policy for sites.
The Reporting API contrib module provides a local endpoint for violation reports, and hosted services for monitoring violations are also available.
The potential for abuse of violation reporting (DoS attacks, bogus data, etc) is outlined at https://www.virtuesecurity.com/blog/abusing-csp-violation-reporting/
Proposed resolution
Implement a basic CSP header for Drupal core configurable through a service parameter, which replaces X-Frame-Options: SAMEORIGIN
Content-Security-Policy: frame-ancestors 'self'
For backwards compatibility of sites that have altered X-Frame-Options from the value set by core and not set a Content Security Policy header, translate the value to an equivalent Content-Security-Policy: frame-ancestors value and throw a deprecation warning.
Remaining tasks
- Service parameter name:
http.response.content_security_policy (like http.response.debug_cacheability_headers) or csp.config (like cors.config) or ?
- Should a
X-Frame-Options header present on a response be removed in 11.x, since browsers will ignore it when CSP is present? - Decide on additional directives to add by default, such as
script-src * 'unsafe-inline'; object-src 'none' - Create followup to remove compatibility layer in 12.0.0, and set default policy in
core.services.yml, and default.services.yml
User interface changes
None
API changes
A new services parameter http.response.content_security_policy has two properties, report_only and enforced, for setting a site's default Content Security Policies.
Modules can modify or replace the default policy headers by implementing a response subscriber.
Draft Change Record
Drupal 11.0 and earlier set a X-Frame-Options: SAMEORIGIN header by default, which can be overridden or removed by other modules.
In Drupal 11.1 and later, this will be replaced with a Content Security Policy header that includes frame-ancestors 'self'. To change the value of the Content Security Policy header, edit the http.response.content_security_policy service parameter.
For backwards compatibility on sites that have customized the X-Frame-Options header, Drupal 11.x will translate it to an equivalent Content-Security-Policy header, unless a customized policy has been defined in the services parameter.
Starting in Drupal 12, any X-Frame-Options header will be ignored, and Content-Security-Policy: frame-ancestors 'self' will be set by default.
