Jenkins: [CSP] Content Security Policy 발생 대처 방법

관련 내용: www.jenkins.io/doc/book/system-administration/security/configuring-content-security-policy/

Configuring Content Security Policy

.css 나 .js 요청 시 아래와 같은 메시지가 발생할 경우가 있다.

Refused to apply inline style because it violates the following Content Security Policy directive: "style-src 'self'". Either the 'unsafe-inline' keyword, a hash ('sha256-Epaif2cHkSx/K62AHKClT5geuHQeilAdJVvUuNPdcuw='), or a nonce ('nonce-...') is required to enable inline execution.

 

그럴 경우 이렇게 대처하면 된다.

 

1. 일시적인 방법

Manage Jenkins -> Script Console

System.clearProperty("hudson.model.DirectoryBrowserSupport.CSP");
System.setProperty("hudson.model.DirectoryBrowserSupport.CSP", "sandbox allow-same-origin allow-scripts; default-src 'self'; script-src * 'unsafe-eval'; img-src *; style-src * 'unsafe-inline'; font-src * data:");

 

2. 영구적인 방법

JVM Option 추가

java -Dhudson.model.DirectoryBrowserSupport.CSP="sandbox allow-same-origin allow-scripts; default-src 'self'; script-src * 'unsafe-eval'; img-src *; style-src * 'unsafe-inline'; font-src * data:" -jar jenkins.war

kb.froglogic.com/squish/integrations/jenkins/content-security-policy-csp-web-report/

Content Security Policy (CSP) for Web Report