csp-report-collector's Introduction

csp-report-collector

Content Security Policy Report Collector

Python Flask App to receive and store CSP violation reports from browsers.

Configuration

The CSP Report Collector is configurable via file and environment variables. Loading environment variables from .env files are also supported.

The configuration file must be called settings.conf.

Environment variables take precedence over options specified in the config file.

ENVVAR	Config File	Example	Description
`CSPRC_DB_URI`	`db_uri`	`mariadb://localhost:3306/csp_reports`	Full database connection string. e.g. `sqlite://db.sqlite`
`CSPRC_DB_TYPE`	`db_type`	`sqlite`, `mariadb`, `mssql`, `postgresql`	The Type of database to use
`CSPRC_DB_HOST`	`db_host`	`localhost`, `127.0.0.1`	The hostname or IP address of the database server
`CSPRC_DB_PORT`	`db_port`	`1433`, `3306`, `5432`	The port of the database server. May be left blank to use the default for the db_type.
`CSPRC_DB_USERNAME`	`db_username`	`user`	The username to authenticate to the db server with
`CSPRC_DB_PASSWORD`	`db_password`	`correcthorsebatterystaple`	The password to authenticate to the db server with
`CSPRC_DB_NAME`	`db_name`	`csp_reports`

You may specify the db connection string as a single db_uri entry, or through a combination of db_uri and other options.

Examples

Using DB_URI Only:

export CSPRC_DB_URI="mariadb://username:password@localhost:3306/csp_reports

Using a combination of DB_URI and individual options:

export CSPRC_DB_URI="mariadb://localhost:3306"
export CSPRC_DB_USERNAME="username"
export CSPRC_DB_PASSWORD="password"
export CSPRC_DB_NAME="csp_reports"

How to use

It is recommended to use the finalduty/csp-report-collector container from Dockerhub, but you may also build a container from the Dockerfile, or install the app locally using pipenv.

The app does not currently support TLS, and so it is recommended to run it behind a TLS Proxy such as Nginx or Traefik.

## Start container
docker run -d --rm -p 8000:8000 -e CSPRC_DB_URI="sqlite:///db.sqlite" --name csp_report_collector finalduty/csp_report_collector

## Check the status endpoint, this should return a 200
curl http://localhost:8000/status

## Submit a test CSP Report, this should return a 204
curl -X POST http://localhost:8000/ -H 'Content-Type: application/csp-report' --data-binary '{"csp-report":{"document-uri":"https://domain.evil/","referrer":"","violated-directive":"frame-ancestors","effective-directive":"frame-ancestors","original-policy":"frame-ancestors *.domain.net;","disposition":"enforce","blocked-uri":"https://domain.evil/","status-code":0,"script-sample":""}}'

## Stop container
docker stop csp_report_collector

License

MIT License

csp-report-collector's People

Contributors

Stargazers

Watchers