You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@airflow.apache.org by "sebbASF (via GitHub)" <gi...@apache.org> on 2025/10/25 16:29:17 UTC
[I] The Content-Security-Policy header must not be overridden [airflow-site]
sebbASF opened a new issue, #1255:
URL: https://github.com/apache/airflow-site/issues/1255
https://github.com/apache/airflow-site/blob/df01d7b0596e4779958b35f89d24101ec148d766/landing-pages/site/static/.htaccess#L53
The Content-Security-Policy header must not be overridden.
There is now a standard way to add local exceptions to the CSP:
https://infra.apache.org/tools/csp.html
Please update the .htaccess file accordingly.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] The Content-Security-Policy header must not be overridden [airflow-site]
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk commented on issue #1255:
URL: https://github.com/apache/airflow-site/issues/1255#issuecomment-3470736558
> The issue is still outstanding. .htaccess currently contains:
>
> ```
> # CSP permissions for foo.apache.org - Adding 3rd party service Algolia. Approved by VP Data Privacy.
> SetEnv CSP_PROJECT_DOMAINS "https://www.youtube-nocookie.com https://www.youtube.com https://airflow.apache.org"
> ```
>
> The comment does not agree with the settings, and there is no documentation for the entries.There is no need to include https://airflow.apache.org.
Yes those are all good points. I barely restored what we had before and indeed - copied comment from the example in https://infra.apache.org/tools/csp.html and restored headers as they were originally - to fix the isssue with not loaded videos.
And yes - I will be happy to correct all those once I got someone to review what we are doing. As instructed in the https://infra.apache.org/tools/csp.html I sent a question to users@infra.apache.org with question on whether what we do is good or not and asking for advices and I am patiently waiting for answers and guidance.
I followed this advice:
> If you need more specifically tailored headers, please reach out to [users@infra.apache.org](mailto:users@infra.apache.org) and we can assist you.
I sent a question but ... I just checked and ... terrible mistake i sent it to users@airflow and not users@infra 🤦 -> autocomplete mistake... (so I am super happy you dragged my attention to it - thanks!) https://lists.apache.org/thread/hr63dfcwl7yd1npj08j3ym6gld50yyz0
I just resent it to users@infra: https://lists.apache.org/thread/l1c84nryh8lywj1fr8s435qb24dlrgot and if you want to make concrete suggestion and help us to understand if what we are doing is good - I think it's best to keep conversation there.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] The Content-Security-Policy header must not be overridden [airflow-site]
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk commented on issue #1255:
URL: https://github.com/apache/airflow-site/issues/1255#issuecomment-3446906246
Removed. We don't need it any more. All our youtube videos are opned on-click in new window.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] The Content-Security-Policy header must not be overridden [airflow-site]
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk closed issue #1255: The Content-Security-Policy header must not be overridden
URL: https://github.com/apache/airflow-site/issues/1255
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] The Content-Security-Policy header must not be overridden [airflow-site]
Posted by "sebbASF (via GitHub)" <gi...@apache.org>.
sebbASF commented on issue #1255:
URL: https://github.com/apache/airflow-site/issues/1255#issuecomment-3470449437
The issue is still outstanding.
.htaccess currently contains:
```
# CSP permissions for foo.apache.org - Adding 3rd party service Algolia. Approved by VP Data Privacy.
SetEnv CSP_PROJECT_DOMAINS "https://www.youtube-nocookie.com https://www.youtube.com https://airflow.apache.org"
```
The comment does not agree with the settings, and there is no documentation for the entries.
There is no need to include https://airflow.apache.org.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] The Content-Security-Policy header must not be overridden [airflow-site]
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk commented on issue #1255:
URL: https://github.com/apache/airflow-site/issues/1255#issuecomment-3453359951
Actually I've found that we had some embeded links to videos from Airflow summit - https://airflow.apache.org/meetups - and we needed those CSP rules. I added them back in the way descriped in the CSP docs and reach out to infra to see if they are ok with it.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] The Content-Security-Policy header must not be overridden [airflow-site]
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk commented on issue #1255:
URL: https://github.com/apache/airflow-site/issues/1255#issuecomment-3453883572
> The process says permission must be obtained _before_ adding any exceptions
I believe we got it before when we had previous content headers. But I am not sure - so as you probably noticed - I've sent a query to ask for it. In the meantime (until this is solved) I prefer to keep it the way it was to not break the user experience.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] The Content-Security-Policy header must not be overridden [airflow-site]
Posted by "sebbASF (via GitHub)" <gi...@apache.org>.
sebbASF commented on issue #1255:
URL: https://github.com/apache/airflow-site/issues/1255#issuecomment-3453838026
The process says permission must be obtained *before* adding any exceptions
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] The Content-Security-Policy header must not be overridden [airflow-site]
Posted by "sebbASF (via GitHub)" <gi...@apache.org>.
sebbASF commented on issue #1255:
URL: https://github.com/apache/airflow-site/issues/1255#issuecomment-3472010913
AIUI:
Approval for hosts added to CSP_PROJECT_DOMAINS needs to be obtained from privacy.apache.org.
You only need to contact infra for other changes to the CSP
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] The Content-Security-Policy header must not be overridden [airflow-site]
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk commented on issue #1255:
URL: https://github.com/apache/airflow-site/issues/1255#issuecomment-3472929668
Noise as usual. I reached out to users@infra and from the response I got from there it looks that I will eventually (and soon) remove those headers and I think I know how - @raboof explained in detail what is wrong and what I should fix.
So I likely will not have to ask again for permissions because likely I will not need those headers.
I recommend you @sebb before next time you tell people what they should do - consider that your advices might be wrong (I do not want to bother privacy if I am to remove those headers) and that sometimes people look for help not for bad 'ordets' what to do from someone who has exactly 0 powers to tell people what to do.
You are a member as any other, you can have opinions and I am eager to get help and advices from others. But I have hard time listening to tho vs that I SHOULD do spoken as of it was ' the only truth in the world' where I am following different path of asking for help and feedback to do the right thing rather than following someone's - not well thought even - because they disregard the context - which nothing more than reciting quotes from policies taken out of context.
If you want to help - I am happy to welcome it but if all what you can do is to order people what they SHOULD do - I am more likely to ignore it as a noise
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] The Content-Security-Policy header must not be overridden [airflow-site]
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk commented on issue #1255:
URL: https://github.com/apache/airflow-site/issues/1255#issuecomment-3453884769
But if you think there are better ways of handling it without breaking user experience while I am waiting for feedback - PRs are most welcome, as usual.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org