fleet/frontend/templates/react.ejs
Jordan Montgomery 076157c1a6
Add CSP to fleet(currently disabled - needs frontend work) (#41395)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #40538

This is the initial iteration of CSP functionality, currently gated
behind FLEET_SERVER_ENABLE_CSP. If disabled, no CSP is served. Nonces
are still injected into pages however a dummy nonce is used and has no
effect.

With this setting turned on things break and will be addressed by mainly
frontend changes in https://github.com/fleetdm/fleet/issues/41577

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes

## Testing

- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)

- [x] QA'd all new/changed functionality manually

---------

Co-authored-by: Gabriel Hernandez <ghernandez345@gmail.com>
2026-03-12 18:06:54 -04:00

39 lines
1.1 KiB
Text

<!DOCTYPE html>
<html>
<head>
<meta charset="UTF-8" />
<meta name="robots" content="noindex" />
<meta name="viewport" content="width=768" id="viewport-meta-tag" />
<meta property="csp-nonce" content="{{.CSPNonce}}" />
<script nonce="{{.CSPNonce}}">
// If URL contains /device/, set mobile-friendly viewport
if (window.location.pathname.includes("/device/")) {
document
.getElementById("viewport-meta-tag")
.setAttribute("content", "width=device-width, initial-scale=1.0");
}
</script>
<link
rel="stylesheet"
type="text/css"
href="{{.URLPrefix}}<%= htmlWebpackPlugin.files.css[0] %>"
/>
<link rel="shortcut icon" href="{{.URLPrefix}}/assets/favicon.ico" />
<title>Fleet</title>
<script type="text/javascript" nonce="{{.CSPNonce}}}">
var urlPrefix = "{{.URLPrefix}}";
</script>
</head>
<body>
<div id="app"></div>
<script
async
defer
nonce="{{.CSPNonce}}"
src="{{.URLPrefix}}<%= htmlWebpackPlugin.files.js[0] %>"
></script>
</body>
</html>