Allow adding connect-src entries

[BlackDex]

Bitwarden allows to use self-hosted forwarded email services. But for this to work you need to add custom URL's to the connect-src CSP entry.

This commit allows setting this and checks if the URL starts with https:// else it will abort loading.

Fixes #5290

[dani-garcia]

I wonder how Bitwarden handles this, do we have a more strict CSP than they do?

A bit annoying that this is an admin config while the option to configure email forward generator is user level. Would it make sense to allow * as a special case to let any domains through (I'm assuming Bitwarden is doing that)?

[larena1]

https://domsignal.com/test/lxyiipdn09ju7rzi5vh8oq2pw885ym5i

Bitwarden included addy in their CSP

[BlackDex]

We also have addy in our CSP.
But if people are allowed to use custom endpoints, then I'm not sure how they will do this.

I have not checked this my self btw.
Will do that later.

[larena1]

But if people are allowed to use custom endpoints, then I'm not sure how they will do this.

Judging by their CSP it might not be possible then

[BlackDex]

Looking at the cloud version, that does not support self-hosted forwarded instances.
The self-hosted Bitwarden does, but it also is blocked by default via the CSP.

There is no easy way to fix this in Self-Hosted Bitwarden besides overwriting the nginx config, which is possible, but not easy.

I would not allow * as that could cause possible security issues. Since people self-host, i would suggest they know which items are allowed. And we already add the hosted endpoints of those services by default.

[dani-garcia]

Nice thanks for the info, LGTM

[ligix]

Since people self-host, i would suggest they know which items are allowed

While this isn't an issue for people who host a small private instance (ex: for their family only) it unnecessarily worsens the CSP for all users.
A better fix would be scoping the CSP changes to only those users who require it but it'd have marginal benefits and would be annoying to implement.

[BlackDex]

Since people self-host, i would suggest they know which items are allowed

While this isn't an issue for people who host a small private instance (ex: for their family only) it unnecessarily worsens the CSP for all users. A better fix would be scoping the CSP changes to only those users who require it but it'd have marginal benefits and would be annoying to implement.

And even impossible since we do not know the user when loading the index page, and thus can not filter on that too change headers per user.

[BJReplay]

Nice. I hadn't noticed that you couldn't use this from the web vault, because the browser extension just works, but it is nice to be able to use it from the web vault, so that you can use the generator while updating logins in bulk from a regular email address to a self-hosted simple login generated email address.