1
Configuration option to allow custom image sources
Source: dani-garcia/vaultwarden#7623 · opened by @kittygaming99
Since we allow customising the web vault's CSS, would it be a good idea to add a configuration option in the admin panel that lets us add a URL to the list of allowed img-src URLs in the content security policy? This is important for loading custom logos that may be hosted externally.
While we can override the content security policy with a reverse proxy like Traefik, this isn't ideal because Vaultwarden's content security policy can change across updates, and it's not possible to add a single URL; you must set the entire policy. I know the current settings list 'self' in img-src. Still, uploading custom logos to the machine running Vaultwarden isn't desirable for everyone, especially given the extra complexity of serving the logo file statically.
Happy to hear people's thoughts. I can write a PR once I've heard people's input.
While we can override the content security policy with a reverse proxy like Traefik, this isn't ideal because Vaultwarden's content security policy can change across updates, and it's not possible to add a single URL; you must set the entire policy. I know the current settings list 'self' in img-src. Still, uploading custom logos to the machine running Vaultwarden isn't desirable for everyone, especially given the extra complexity of serving the logo file statically.
Happy to hear people's thoughts. I can write a PR once I've heard people's input.
No pledges yet. Be the first to back this.
Comments
Similar requests
feat: allow sensitive environment variables to be the path to a file that contains the value
1 vote · 0 comments
Disable 2FA email setup button if email 2FA is disabled in admin settings
1 vote · 0 comments
Wiki edit request: note regarding Forgejo(/Gitea?) SSO_AUTHORITY trailing slash
1 vote · 0 comments
Kubernetes Ingress Nginx configuration for Websocket support
2 votes · 0 comments
Protect Admin panel by restricting access to only IP LAN
2 votes · 0 comments
No comments yet.