2016-08-10 05:15:44 +00:00
|
|
|
<!DOCTYPE html>
|
2019-10-16 23:40:45 +00:00
|
|
|
<html>
|
2016-08-10 05:15:44 +00:00
|
|
|
<head>
|
2025-12-12 17:40:27 +00:00
|
|
|
<meta charset="UTF-8" />
|
|
|
|
|
<meta name="robots" content="noindex" />
|
|
|
|
|
<meta name="viewport" content="width=768" id="viewport-meta-tag" />
|
Add CSP to fleet(currently disabled - needs frontend work) (#41395)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #40538
This is the initial iteration of CSP functionality, currently gated
behind FLEET_SERVER_ENABLE_CSP. If disabled, no CSP is served. Nonces
are still injected into pages however a dummy nonce is used and has no
effect.
With this setting turned on things break and will be addressed by mainly
frontend changes in https://github.com/fleetdm/fleet/issues/41577
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
---------
Co-authored-by: Gabriel Hernandez <ghernandez345@gmail.com>
2026-03-12 22:06:54 +00:00
|
|
|
<meta property="csp-nonce" content="{{.CSPNonce}}" />
|
2023-01-06 14:57:32 +00:00
|
|
|
|
Add CSP to fleet(currently disabled - needs frontend work) (#41395)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #40538
This is the initial iteration of CSP functionality, currently gated
behind FLEET_SERVER_ENABLE_CSP. If disabled, no CSP is served. Nonces
are still injected into pages however a dummy nonce is used and has no
effect.
With this setting turned on things break and will be addressed by mainly
frontend changes in https://github.com/fleetdm/fleet/issues/41577
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
---------
Co-authored-by: Gabriel Hernandez <ghernandez345@gmail.com>
2026-03-12 22:06:54 +00:00
|
|
|
<script nonce="{{.CSPNonce}}">
|
2025-12-12 17:40:27 +00:00
|
|
|
// If URL contains /device/, set mobile-friendly viewport
|
|
|
|
|
if (window.location.pathname.includes("/device/")) {
|
|
|
|
|
document
|
|
|
|
|
.getElementById("viewport-meta-tag")
|
|
|
|
|
.setAttribute("content", "width=device-width, initial-scale=1.0");
|
|
|
|
|
}
|
2023-01-06 14:57:32 +00:00
|
|
|
</script>
|
2022-08-01 10:27:12 +00:00
|
|
|
|
|
|
|
|
<link
|
|
|
|
|
rel="stylesheet"
|
|
|
|
|
type="text/css"
|
|
|
|
|
href="{{.URLPrefix}}<%= htmlWebpackPlugin.files.css[0] %>"
|
|
|
|
|
/>
|
|
|
|
|
<link rel="shortcut icon" href="{{.URLPrefix}}/assets/favicon.ico" />
|
2017-01-06 17:28:34 +00:00
|
|
|
|
2024-01-12 14:27:56 +00:00
|
|
|
<title>Fleet</title>
|
Add CSP to fleet(currently disabled - needs frontend work) (#41395)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #40538
This is the initial iteration of CSP functionality, currently gated
behind FLEET_SERVER_ENABLE_CSP. If disabled, no CSP is served. Nonces
are still injected into pages however a dummy nonce is used and has no
effect.
With this setting turned on things break and will be addressed by mainly
frontend changes in https://github.com/fleetdm/fleet/issues/41577
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
---------
Co-authored-by: Gabriel Hernandez <ghernandez345@gmail.com>
2026-03-12 22:06:54 +00:00
|
|
|
<script type="text/javascript" nonce="{{.CSPNonce}}}">
|
2022-08-01 10:27:12 +00:00
|
|
|
var urlPrefix = "{{.URLPrefix}}";
|
2019-10-16 23:40:45 +00:00
|
|
|
</script>
|
2016-08-10 05:15:44 +00:00
|
|
|
</head>
|
|
|
|
|
<body>
|
|
|
|
|
<div id="app"></div>
|
2022-08-01 10:27:12 +00:00
|
|
|
<script
|
|
|
|
|
async
|
|
|
|
|
defer
|
Add CSP to fleet(currently disabled - needs frontend work) (#41395)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #40538
This is the initial iteration of CSP functionality, currently gated
behind FLEET_SERVER_ENABLE_CSP. If disabled, no CSP is served. Nonces
are still injected into pages however a dummy nonce is used and has no
effect.
With this setting turned on things break and will be addressed by mainly
frontend changes in https://github.com/fleetdm/fleet/issues/41577
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
---------
Co-authored-by: Gabriel Hernandez <ghernandez345@gmail.com>
2026-03-12 22:06:54 +00:00
|
|
|
nonce="{{.CSPNonce}}"
|
2022-08-01 10:27:12 +00:00
|
|
|
src="{{.URLPrefix}}<%= htmlWebpackPlugin.files.js[0] %>"
|
|
|
|
|
></script>
|
2016-08-10 05:15:44 +00:00
|
|
|
</body>
|
|
|
|
|
</html>
|