mirror of https://github.com/windmill-labs/windmill.git synced 2026-08-20 08:01:35 +00:00

Files

T

claude[bot] 19af16729c fix: optionally enable CSP headers (#6033 )

* feat: add optional CSP headers when ENABLE_CSP_HEADERS is set

- Add middleware to conditionally set Content-Security-Policy headers
- Check for ENABLE_CSP_HEADERS environment variable  
- Apply secure default CSP policy suitable for web applications
- Follows existing middleware patterns in codebase

Resolves #6031

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-authored-by: Ruben Fiszel <rubenfiszel@users.noreply.github.com>

* perf: optimize CSP headers with lazy_static and add configurability

- Cache CSP_ENABLED and CSP_POLICY using lazy_static to avoid env var lookups on every request
- Add comprehensive documentation to add_csp_headers middleware function
- Make CSP policy configurable via CSP_POLICY environment variable
- Maintain backward compatibility with secure default policy
- Implement proper error handling for custom CSP policy values

Co-authored-by: Alexander Petric &lt;alpetric@users.noreply.github.com&gt;

* refactor: conditionally add CSP middleware layer instead of NO-OP

- Use .option_layer() to only add CSP middleware when ENABLE_CSP_HEADERS is set
- Remove runtime conditional check from add_csp_headers function
- Improve performance by avoiding unnecessary middleware execution when disabled

Co-authored-by: Ruben Fiszel <rubenfiszel@users.noreply.github.com>

* refactor: conditionally add CSP middleware layer instead of NO-OP

Remove CSP_ENABLED variable and instead check if CSP_POLICY is not empty.
This eliminates the need for a separate enable flag and simplifies the logic
to just check if a meaningful CSP policy is configured.

- Remove CSP_ENABLED lazy_static variable
- Simplify CSP_POLICY to use unwrap_or_default()
- Update conditional middleware logic to check !CSP_POLICY.is_empty()
- Update documentation to reflect new behavior

Co-authored-by: Ruben Fiszel <rubenfiszel@users.noreply.github.com>

* refactor: conditionally add CSP middleware layer instead of NO-OP

Move CSP headers from general middleware stack to static assets only.
CSP headers are only relevant for browsers consuming static content,
not for API endpoints.

Changes:
- Add CSP headers directly to static asset responses in serve_path()
- Remove CSP middleware from general middleware stack
- Remove unused add_csp_headers middleware function
- Maintain same CSP_POLICY environment variable configuration

Co-authored-by: Alexander Petric <alpetric@users.noreply.github.com>

* fix: conditionally compile CSP header imports with static_frontend feature

Fixes unused import errors by wrapping HeaderValue and CSP_POLICY imports 
with #[cfg(feature = "static_frontend")] to match their usage context.

Co-authored-by: Alexander Petric <alpetric@users.noreply.github.com>

* refactor: move CSP lazy static block to static_assets.rs

- Move CSP_POLICY lazy static from lib.rs to static_assets.rs for better encapsulation
- Remove crate-level import since CSP_POLICY is now local to static_assets module
- Maintain same functionality with proper feature gating for static_frontend

Co-authored-by: Ruben Fiszel <rubenfiszel@users.noreply.github.com>

---------

Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com>
Co-authored-by: Ruben Fiszel <rubenfiszel@users.noreply.github.com>
Co-authored-by: Alexander Petric <alpetric@users.noreply.github.com>