Contentsecuritypolicy not working

Traefik Traefik v2
1

- traefik.http.middlewares.simpleweb-csp.headers.contentsecuritypolicy=style-src 'self'

I added the above to the docker yml file, recreated container etc, but the content security policy header is still not added.

This is in docker swarm.

How to debug?

2

You need to declare the middlewares and you need to assign the middlewares to the router:

  whoami:
    image: traefik/whoami:v1.10
    networks:
      - proxy
    labels:
      - traefik.enable=true
      - traefik.http.routers.mywhoami.rule=Host(`whoami.example.com`) || Host(`www.whoami.example.com`)
      - traefik.http.services.mywhoami.loadbalancer.server.port=80

      - traefik.http.middlewares.mywwwredirect.redirectregex.regex=^https://www\.(.*)
      - traefik.http.middlewares.mywwwredirect.redirectregex.replacement=https://$${1}
      - traefik.http.routers.mywhoami.middlewares=mywwwredirect

Snippet from simple Traefik example.

3

So something like this:

- traefik.http.routers.mydashboard.middlewares=myauth
- traefik.http.middlewares.myauth.headers.contentsecuritypolicy=style-src 'self'
4

Tried above, still not working

The strange thing is, if I set the CSP header (form-action 'self') from my app then it does not work, browser blocks the form submission. Any idea why?

5

I am running the apps in a stack.

What i did was

docker service scale app=0
docker rm <my container>
docker service scale app=1

Are these enough?

6

Hmm if I run this

docker inspect -f "{{json .Config.Labels}}" $cid

I don't see any traefik labels!

7

I am using v2.3, is this the problem?

8

You need to run docker stack deploy to update the stack services or use the appropriate docker service command to add the labels.

Use docker service inspect, as with Swarm the Traefik labels are on the Docker service.

Of course you can run a 3 year old Traefik version, but what prevents you from using a current v2.11? Many bugs and security issues fixed.

9

Thanks! I had to do a stack rm and deploy the stack again to make it work.
As for 2.3 to 2.11, I am thinking to upgrade to 3.0.0, is 3.0.0 stable enough?

thanks

10

v3.0 is officially released, so is considered stable.

Check the migration guide, Swarm provider changed from providers.docker to providers.swarm.

Make sure to test config on a separate system, don’t just deploy new version in production.