Skip to content

fix(security+frontend): debug-session batch 3 — CSP wss tighten, ssot https detection #6751

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mrveiss merged 2 commits into from
May 2, 2026
Merged

fix(security+frontend): debug-session batch 3 — CSP wss tighten, ssot https detection #6751

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
f3801d3
fix(security/csp): tighten connect-src wss to same-host instead of an…
mrveiss May 2, 2026
96cc502
fix(frontend/config): runtime-detect https for backendUrl + frontendU…
mrveiss May 2, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 16 additions & 2 deletions autobot-frontend/src/config/ssot-config.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -438,11 +438,25 @@ function buildConfig(): AutoBotConfig {

// Computed URLs as getters
get backendUrl(): string {
return `${httpProtocol}://${vm.main}:${port.backend}`;
// #6642 pattern: detect protocol from window.location at runtime, not
// from build-time VITE_HTTP_PROTOCOL. The env var defaults to 'http'
// and produced http:// URLs that browsers blocked as mixed-content
// when the page itself was served over HTTPS. Mirror the runtime
// detection that getBackendWsUrl() and websocketUrl already use so
// behaviour stays correct regardless of the build-time env.
const proto =
typeof window !== 'undefined'
? (window.location.protocol === 'https:' ? 'https' : 'http')
: httpProtocol;
return `${proto}://${vm.main}:${port.backend}`;
},

get frontendUrl(): string {
return `${httpProtocol}://${vm.frontend}:${port.frontend}`;
const proto =
typeof window !== 'undefined'
? (window.location.protocol === 'https:' ? 'https' : 'http')
: httpProtocol;
return `${proto}://${vm.frontend}:${port.frontend}`;
},

get redisUrl(): string {
Expand Down
6 changes: 3 additions & 3 deletions autobot-slm-backend/ansible/roles/slm_manager/templates/autobot-slm.conf.j2
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,7 +41,7 @@ server {
add_header X-XSS-Protection "1; mode=block" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
# Issue #1015: Content Security Policy
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'; connect-src 'self' wss:; frame-ancestors 'none'; base-uri 'self'; form-action 'self';" always;
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'; connect-src 'self' wss://$host; frame-ancestors 'none'; base-uri 'self'; form-action 'self';" always;

# Issue #1090: Allow SLM agent event sync payloads (typically 1.5-2MB)
client_max_body_size 10m;
Expand Down Expand Up @@ -266,7 +266,7 @@ server {
add_header X-Content-Type-Options "nosniff" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self' data:; connect-src 'self' wss:; frame-ancestors 'self'; base-uri 'self';" always;
add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self' data:; connect-src 'self' wss://$host; frame-ancestors 'self'; base-uri 'self';" always;
}

# Grafana reverse proxy (monitoring dashboards)
Expand All @@ -285,7 +285,7 @@ server {
add_header X-Content-Type-Options "nosniff" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self' data:; connect-src 'self' wss:; frame-ancestors 'self'; base-uri 'self';" always;
add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self' data:; connect-src 'self' wss://$host; frame-ancestors 'self'; base-uri 'self';" always;
{% if grafana_enable_cors | default(false) %}

# CORS headers for external Grafana iframe embedding
Expand Down
Loading