Skip to content

[v6.2] Fix CSP/X-Frame-Options headers #80

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
simonhammes wants to merge 4 commits into
base: main
Choose a base branch
from
+5 −9
Draft

[v6.2] Fix CSP/X-Frame-Options headers #80

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
09f1fac
ALLOWALL is not a valid value for the X-Frame-Options header
simonhammes May 15, 2026
18706d0
Remove default CSP settings for /dtable/external-apps-edit/*
simonhammes May 15, 2026
dd8e3ee
Introduce COLLABORA_HOSTNAME variable
simonhammes May 18, 2026
133b6fd
Introduce ONLYOFFICE_HOSTNAME variable
simonhammes May 18, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 5 additions & 9 deletions compose/seatable-server.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -66,13 +66,13 @@ services:
default-src 'none';
style-src 'unsafe-inline' 'self' fonts.googleapis.com;
script-src 'unsafe-inline' 'unsafe-eval' 'self';
script-src-elem 'unsafe-inline' 'self' ${SEATABLE_SERVER_HOSTNAME}:${ONLYOFFICE_PORT:-6233} maps.googleapis.com unpkg.com;
script-src-elem 'unsafe-inline' 'self' ${SEATABLE_SERVER_HOSTNAME}:${ONLYOFFICE_PORT:-6233} ${ONLYOFFICE_HOSTNAME:-} maps.googleapis.com unpkg.com;
font-src 'self' data: unpkg.com ${SEATABLE_SERVER_HOSTNAME}:${TLDRAW_PORT:-6239} fonts.gstatic.com;
img-src 'self' data: blob: https: market.seatable.io market.seatable.com mt0.google.com maps.googleapis.com maps.gstatic.com;
media-src 'self';
form-action 'self' ${SEATABLE_SERVER_HOSTNAME}:${COLLABORA_PORT:-6232};
form-action 'self' ${SEATABLE_SERVER_HOSTNAME}:${COLLABORA_PORT:-6232} ${COLLABORA_HOSTNAME:-};
connect-src 'self' market.seatable.io market.seatable.com https: ws: blob: data:;
frame-src 'self' ${SEATABLE_SERVER_HOSTNAME}:${COLLABORA_PORT:-6232} ${SEATABLE_SERVER_HOSTNAME}:${ONLYOFFICE_PORT:-6233};
frame-src 'self' ${SEATABLE_SERVER_HOSTNAME}:${COLLABORA_PORT:-6232} ${COLLABORA_HOSTNAME:-} ${SEATABLE_SERVER_HOSTNAME}:${ONLYOFFICE_PORT:-6233} ${ONLYOFFICE_HOSTNAME:-};
frame-ancestors 'self';
worker-src 'self' blob:;
manifest-src 'self';
Expand All @@ -81,23 +81,19 @@ services:
`"
# Allow iframes for some directories
caddy_0.route_0: /dtable/view-external-links/*
caddy_0.route_0.header.X-Frame-Options: "ALLOWALL"
caddy_0.route_0.header.-Content-Security-Policy: ""
caddy_0.route_1: /dtable/external-links/*
caddy_0.route_1.header.X-Frame-Options: "ALLOWALL"
caddy_0.route_1.header.-Content-Security-Policy: ""
caddy_0.route_2: /dtable/external-apps/*
caddy_0.route_2.header.X-Frame-Options: "ALLOWALL"
caddy_0.route_2.header.-Content-Security-Policy: ""
caddy_0.route_3: /dtable/forms/*
caddy_0.route_3.header.X-Frame-Options: "ALLOWALL"
caddy_0.route_3.header.-Content-Security-Policy: ""
caddy_0.route_4: /apps/custom/*
caddy_0.route_4.header.X-Frame-Options: "ALLOWALL"
caddy_0.route_4.header.-Content-Security-Policy: ""
caddy_0.route_5: /external-apps/*
caddy_0.route_5.header.X-Frame-Options: "ALLOWALL"
caddy_0.route_5.header.-Content-Security-Policy: ""
Comment on lines 93 to 94
Copy link
Copy Markdown
Collaborator Author

@simonhammes simonhammes May 15, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This completely removes the CSP header for all universal apps.

What was the initial purpose of this? Allow embedding apps and forms within other pages? The commit message of dbe7f6c suggests this.

We could do this through a frame-ancestors directive

Copy link
Copy Markdown
Collaborator Author

@simonhammes simonhammes May 15, 2026 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Completely disabling the CSP for a bunch of path prefixes seems like the wrong approach for this

We could do this through a frame-ancestors directive

However, this should probaly still be path-scoped to prevent unnecessary risk of clickjacking attacks.

Maybe strict SameSite settings for auth cookies are "enough" to defend against clickjacking attacks:

As an additional partial mitigation, sites should set the SameSite cookie attribute for session cookies to Lax or Strict. Requests from embedded contexts such as <iframe> elements that are not same-site with the top-level document will not include these cookies, and the server will therefore not treat the request as coming from a logged-in user.

caddy_0.route_6: /dtable/external-apps-edit/*
caddy_0.route_6.header.-Content-Security-Policy: ""

caddy_1: ":80"
caddy_1.@http.protocol: "http"
Expand Down