You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@arrow.apache.org by "sebbASF (via GitHub)" <gi...@apache.org> on 2025/10/25 12:09:34 UTC

[I] The Content-Security-Policy header must not be overridden [arrow-site]

sebbASF opened a new issue, #723:
URL: https://github.com/apache/arrow-site/issues/723

   https://github.com/apache/arrow-site/blob/0a7594a059837f9324ee769fa29c5e84d6103156/.htaccess#L31
   
   The Content-Security-Policy header must not be overridden.
   
   There is now a standard way to add local exceptions to the CSP:
   
   https://infra.apache.org/tools/csp.html
   
   Please update the .htaccess file accordingly.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@arrow.apache.org.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] The Content-Security-Policy header must not be overridden [arrow-site]

Posted by "sebbASF (via GitHub)" <gi...@apache.org>.
sebbASF commented on issue #723:
URL: https://github.com/apache/arrow-site/issues/723#issuecomment-3474114316

   Which pages have the kapa.ai bot? I could not find any reference to it except in the htaccess CSP override.
   
   Note that there are ways to test changes to the CSP without affecting the deployed site.
   You could set up a preview site (define this in .asf.yaml).
   
   Or the Attic project has a Docker definition that can apply any desired CSP to a remote website.
   Details are in https://github.com/apache/attic/blob/main/DOCKER.md
   
   The basic commands are:
   
   ```$ docker compose build```
   (only needs to be done once, unless you change any files)
   
   ```VAR_HOSTURL=https://beam.apache.org/ CSP_PROJECT_DOMAINS="host1 host2" docker compose up```
   
   Navigate to localhost:8000
   
   If you enable browser debugging, you should be able to see if there are any CSP errors in the console log.
   
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@arrow.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] The Content-Security-Policy header must not be overridden [arrow-site]

Posted by "amoeba (via GitHub)" <gi...@apache.org>.
amoeba commented on issue #723:
URL: https://github.com/apache/arrow-site/issues/723#issuecomment-3446888223

   Thanks @sebbASF. @thisisnic are you able to take a look at this?


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@arrow.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] The Content-Security-Policy header must not be overridden [arrow-site]

Posted by "thisisnic (via GitHub)" <gi...@apache.org>.
thisisnic commented on issue #723:
URL: https://github.com/apache/arrow-site/issues/723#issuecomment-3460297176

   Thanks for the info @sebbASF. I was wondering if you know of other projects which are using the kapa.ai bot which have needed to do the same, so I can compare to those and check if it looks right before I merge? Last time we updated the .htaccess file, it took a lot of rounds to get it right while trying not to take out the website for too long.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@arrow.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] The Content-Security-Policy header must not be overridden [arrow-site]

Posted by "pitrou (via GitHub)" <gi...@apache.org>.
pitrou commented on issue #723:
URL: https://github.com/apache/arrow-site/issues/723#issuecomment-4162646996

   @raulcd FYI


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@arrow.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] The Content-Security-Policy header must not be overridden [arrow-site]

Posted by "thisisnic (via GitHub)" <gi...@apache.org>.
thisisnic commented on issue #723:
URL: https://github.com/apache/arrow-site/issues/723#issuecomment-3446940037

   Thanks for the ping @amoeba, will take a look next week.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@arrow.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] The Content-Security-Policy header must not be overridden [arrow-site]

Posted by "sebbASF (via GitHub)" <gi...@apache.org>.
sebbASF commented on issue #723:
URL: https://github.com/apache/arrow-site/issues/723#issuecomment-3458912770

   Please note that the policy says that any exceptions must have been approved, and a reference to the approval must be commented in the .htaccess file


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@arrow.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org