You're viewing version 2.13 of the OpenSearch documentation. This version is no longer maintained. For the latest version, see the current documentation. For information about OpenSearch version maintenance, see Release Schedule and Maintenance Policy.
Configuring Content Security Policy rules dynamically
Introduced 2.13
Content Security Policy (CSP) is a security standard intended to prevent cross-site scripting (XSS), clickjacking
, and other code injection attacks resulting from the execution of malicious content in the trusted webpage context. OpenSearch Dashboards supports configuring CSP rules in the opensearch_dashboards.yml
file by using the csp.rules
key. A change in the YAML file requires a server restart, which may interrupt service availability. You can, however, configure the CSP rules dynamically through the applicationConfig
plugin without restarting the server.
Configuration
The applicationConfig
plugin provides read and write APIs that allow OpenSearch Dashboards users to manage dynamic configurations as key-value pairs in an index. The cspHandler
plugin registers a pre-response handler to HttpServiceSetup
, which gets CSP rules from the dependent applicationConfig
plugin and then rewrites to the CSP header. Enable both plugins within your opensearch_dashboards.yml
file to use this feature. The configuration is shown in the following example. Refer to the cspHandler
plugin README for configuration details.
application_config.enabled: true
csp_handler.enabled: true
Enable site embedding for OpenSearch Dashboards
To enable site embedding for OpenSearch Dashboards, update the CSP rules using CURL. When using CURL commands with single quotation marks inside the data-raw
parameter, escape them with a backslash (\
). For example, use '\''
to represent '
. The configuration is shown in the following example. Refer to the applicationConfig
plugin README for configuration details.
curl '{osd endpoint}/api/appconfig/csp.rules' -X POST -H 'Accept: application/json' -H 'Content-Type: application/json' -H 'osd-xsrf: osd-fetch' -H 'Sec-Fetch-Dest: empty' --data-raw '{"newValue":"script-src '\''unsafe-eval'\'' '\''self'\''; worker-src blob: '\''self'\''; style-src '\''unsafe-inline'\'' '\''self'\''; frame-ancestors '\''self'\'' {new site}"}'
Delete CSP rules
Use the following CURL command to delete CSP rules:
curl '{osd endpoint}/api/appconfig/csp.rules' -X DELETE -H 'osd-xsrf: osd-fetch' -H 'Sec-Fetch-Dest: empty'
Get CSP rules
Use the following CURL command to get CSP rules:
curl '{osd endpoint}/api/appconfig/csp.rules'
Precedence
Dynamic configurations override YAML configurations, except for empty CSP rules. To prevent clickjacking
, a frame-ancestors: self
directive is automatically added to YAML-defined rules when necessary.