feat(api): send Permissions-Policy header on all responses - #1221
Conversation
Console serves the bundled Angular UI itself, so it owns the response headers on that document. Extend the existing nosniff middleware to also send a Permissions-Policy denying the browser APIs the UI never uses. Postman collections check for it. The default keeps clipboard-write and fullscreen at self: the copy buttons and the KVM viewer need them, so a blanket deny-all policy would break both. HTTP_PERMISSIONS_POLICY / http.permissions_policy overrides the value, and an empty one sends no header. Deployments that host the UI elsewhere, or front Console with a gateway that sets its own policy, can own the header instead.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #1221 +/- ##
==========================================
+ Coverage 50.61% 50.62% +0.01%
==========================================
Files 148 148
Lines 13783 13786 +3
==========================================
+ Hits 6976 6979 +3
Misses 6206 6206
Partials 601 601 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
There was a problem hiding this comment.
Pull request overview
Adds a configurable Permissions-Policy response header (alongside the existing X-Content-Type-Options: nosniff) to harden the embedded UI/document responses and keep response headers under Console’s control, with an opt-out for deployments where a gateway or external UI host should own the policy.
Changes:
- Extend the existing security-headers middleware to optionally emit
Permissions-Policyon all responses, driven byhttp.permissions_policy/HTTP_PERMISSIONS_POLICY. - Introduce
config.DefaultPermissionsPolicyand wire it into default configuration and unit tests. - Update Postman collections to assert the shipped default
Permissions-Policyis present.
Reviewed changes
Copilot reviewed 7 out of 7 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| internal/app/app.go | Pass configured permissions policy into the security-headers middleware and emit Permissions-Policy when non-empty. |
| internal/app/app_test.go | Expand middleware tests to cover presence/absence of Permissions-Policy across response shapes and ensure default policy retains required features. |
| integration-test/collections/console_rps_apis.postman_collection.json | Add Postman assertions that responses include a default Permissions-Policy header. |
| integration-test/collections/console_mps_apis.postman_collection.json | Add Postman assertions that responses include a default Permissions-Policy header. |
| config/config.go | Define DefaultPermissionsPolicy, add PermissionsPolicy config field, and set its default. |
| config/config_test.go | Assert PermissionsPolicy default is set in NewConfig() defaults. |
| .env.example | Document HTTP_PERMISSIONS_POLICY behavior and the “empty disables header” option. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
sudhir-intc
left a comment
sudhir-intc
left a comment
There was a problem hiding this comment.
LGTM, please change the PR title to refactor so that the console release binary does not get generated.
|
I think lets just hold on to it until we can release again. This isn't holding anything up, we don't have a customer asking for it. Thanks |
Console serves the bundled Angular UI itself, so it owns the response headers on that document. Extend the existing nosniff middleware to also send a Permissions-Policy denying the browser APIs the UI never uses. Postman collections check for it.
The default keeps clipboard-write and fullscreen at self: the copy buttons and the KVM viewer need them, so a blanket deny-all policy would break both.
HTTP_PERMISSIONS_POLICY / http.permissions_policy overrides the value, and an empty one sends no header. Deployments that host the UI elsewhere, or front Console with a gateway that sets its own policy, can own the header instead.