gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
Koha-clms/etc
History
Martin Renvoize 4971626204
Bug 38365: Add CSP violation reporting API endpoint 
Add /api/v1/public/csp-reports endpoint to receive and log
Content-Security-Policy violation reports from browsers.

When CSP is configured with a report-uri directive pointing to this
endpoint, browsers will POST violation reports whenever a CSP rule
is violated. These reports are logged using Koha's logging system
for administrator review.

Features:
- Public endpoint (no authentication required, as browsers send
  these reports automatically)
- Logs violations at WARN level with key details (violated directive,
  blocked URI, document URI, source location)
- Logs full report at DEBUG level for detailed analysis
- Accepts both application/csp-report and application/json content types

Configuration example (in koha-conf.xml csp_header_value):
  ...; report-uri /api/v1/public/csp-reports

Log4perl configuration to capture CSP violations:
  log4perl.logger.api.csp = WARN, CSP
  log4perl.appender.CSP = Log::Log4perl::Appender::File
  log4perl.appender.CSP.filename = /var/log/koha/csp-violations.log
  log4perl.appender.CSP.layout = PatternLayout
  log4perl.appender.CSP.layout.ConversionPattern = [%d] %m%n

Also updates koha-conf.xml documentation with CSP configuration guidance.

Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Lari Taskula <lari.taskula@hypernova.fi>
Signed-off-by: David Cook <dcook@prosentient.com.au>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
 		2026-03-16 11:57:15 +01:00
..
z3950 Bug 39303: Add audience index to SRU 2025-04-25 08:47:14 +02:00
zebradb Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
README.txt
…
SIPconfig.xml Bug 37893: Add warning notes to obsolete xml file sections 2025-11-18 11:21:06 -07:00
apache.conf
…
koha-conf.xml Bug 38365: Add CSP violation reporting API endpoint 2026-03-16 11:57:15 +01:00
koha-httpd.conf Bug 40993: (follow-up) Add changes to etc/koha-httpd.conf 2026-01-13 10:12:21 -07:00
koha-worker.service Bug 32992: Move background_jobs_worker to misc/workers 2023-02-24 17:52:19 -03:00
log4perl.conf Bug 36954: (follow-up) Return to the two logfiles pattern 2025-02-18 10:55:27 +01:00
nginx.conf Bug 32716: larger proxy_buffer_size in NGINX example config 2023-04-14 11:35:18 -03:00

README.txt 

Koha Configuration Files:

The following files specify the base configuration for Koha ZOOM:

 * koha-httpd.conf  
In a debian system, this apache configuration file will be symlinked
from /etc/apache2/sites-enabled
Specify Koha's IP address with NameVirtualHost
Set ServerName, etc

 * koha-production.xml  
 * koha-testing.xml 
These are the production and testing configurations for zebrasrv and for Koha.
The first part of each file specifies Zebra server names, indexing configuration files,
and query language configurations.  Koha configuration directives follow. 

 * zebra-authorities.cfg  
 * zebra-biblios.cfg