Repository navigation
docs(security): document stored asset CSP and CDN requirements - #2613
Merged
Merged
Conversation
Developer Docs healthcheckStatus: Completed with |
This was referenced Oct 15, 2026
Soner (shyim)
approved these changes
Oct 15, 2026
Jonas Elfering (keulinho)
changed the title
Jonas Elfering (keulinho)
requested review from
Jens (jenskueper),
Niklas Dzösch (ndzoesch) and
l.tepner (sw54904)
October 15, 2026 11:32
Jens (jenskueper)
approved these changes
Oct 15, 2026
l.tepner (sw54904)
approved these changes
Oct 15, 2026
Contributor
There was a problem hiding this comment.
🔵 Needs a closer look
The linked core change remains unmerged, so release coordination requires human confirmation before approval.
1 open finding
What changed in this PR
Documents stored-asset CSP protection in Shopware’s server examples and security reference, while preserving application-rendered page behavior.
Changes:
- Strengthens CSP for stored HTML and SVG across Apache, Nginx and Caddy.
- Explains CDN header configuration, reverse-proxy preservation and deployment requirements.
| File | Description |
|---|---|
| resources/references/security.md | Adds stored-asset XSS protection and deployment guidance |
| resources/references/config-reference/server/nginx.md | Adds stored HTML protection and updates SVG handling |
| resources/references/config-reference/server/caddy.md | Extends CSP matching to existing stored documents |
| resources/references/config-reference/server/apache.md | Adds HTML and SVG CSP rules |
🧠 Review effort: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
|
|
||
| This policy blocks scripts, embedded documents, base URL overrides and form submissions while permitting images and styles. It must be present on the asset response, including when a cache serves the file. | ||
|
|
||
| The provided [Apache](./config-reference/server/apache.md), [Nginx](./config-reference/server/nginx.md) and [Caddy](./config-reference/server/caddy.md) configurations include CSP protection for stored HTML and SVG. Update and deploy existing configurations to receive these protections. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Document CSP protection for stored HTML and SVG in the Apache, Nginx and Caddy examples. Application-rendered pages and bundled HTML applications retain their existing behavior.
Add a dedicated XSS on stored assets section to the security reference. Explain why application CSP does not protect independently served assets, link to the webserver configuration pages, and require manual response-header configuration when a dedicated CDN serves assets from a different CDN URL. For reverse proxies, explain that the origin CSP must be preserved, including cached responses, and that Shopware's default Fastly and Varnish configurations already do so. Existing installations must update and deploy their webserver configurations. The reverse-cache guide remains unchanged; no VCL snippets or new proxy policies are documented.
Related links
Checklist
PageRefreferences where relevant.Notes
Markdown lint passes for the server examples; spelling and link checks pass for the security reference. The Apache example contains the policy directly in its existing virtual-host block, using a header expression for existing media/thumbnail HTML. The extracted combined example passes Apache syntax validation and 12 HTTP cases with a fixture PHP front controller; missing HTML media also retains the application's policy. Earlier validation of the unchanged Caddy/Nginx config blocks passed native checks and 25 HTTP cases. Origin CSP propagation was verified against the existing Varnish configs and adapted Fastly snippets locally. No full documentation-site build or live Fastly validation was performed. Keep this draft until the linked webserver configuration changes are available.