tree 7d39cad56f5128dda0229893a3c6579a63973cd3
parent 8943d9c33b8cb31d451f2a3064dcd427a6b2a153
author Jan Lehnardt <jan@apache.org> 1627072122 +0200
committer Nick Vatamaniuc <nickva@users.noreply.github.com> 1631555651 -0400

feat: backport fine-grained CSP support to 3.1.x

The original commit [0] was in 3.x branch

This introduces CSP settings for attachments and show/list funs and
streamlines the configuration with the existing Fauxton CSP options.

Deprecates the old `[csp] enable` and `[csp] header_value` config
options, but they are honoured going forward.

They are replaced with `[csp] utils_enable` and `[csp] utils_header_value`
respectively. The functionality and default values remain the same.

In addition, these new config options are added, along with their
default values:

```
[csp]
attachments_enable = false
attachments_header_value = sandbox
showlist_enable = false
showlist_header_value = sandbox
```

When enabled, these add `Content-Security-Policy` headers to all attachment
requests and to all non-JSON show and all list function responses.

Co-authored-by: Nick Vatamaniuc <vatamane@gmail.com>
Co-authored-by: Robert Newson <rnewson@apache.org>

[0] https://github.com/apache/couchdb/commit/64281c0358e206a54e3b1386a7bc3b3e7c30547f