Brijesh Bhalala created ATLAS-5363:
--------------------------------------
Summary: Atlas Documentation UI: REST API documentation styling
broken on atlas.apache.org due to CSP violation
Key: ATLAS-5363
URL: https://issues.apache.org/jira/browse/ATLAS-5363
Project: Atlas
Issue Type: Task
Components: atlas-webui
Reporter: Brijesh Bhalala
Assignee: Brijesh Bhalala
The REST API documentation hosted at
[https://atlas.apache.org/api/v2/index.html] is currently rendering as raw,
unstyled HTML. The Bootstrap CSS required to style the page is being blocked by
the browser due to a Content Security Policy (CSP) violation.
*Root Cause:* The Enunciate plugin generates the {{index.html}} file using an
external CDN link for Bootstrap: {{<link rel="stylesheet"
href="https://stackpath.bootstrapcdn.com/bootstrap/3.4.1/css/bootstrap.min.css";>}}
However, the Apache infrastructure enforces a strict CSP header for
{{*.apache.org}} sites which restricts the {{style-src}} directive to a
specific whitelist (e.g., {{{}'self'{}}}, {{{}*.apache.org{}}}, etc.). Since
{{stackpath.bootstrapcdn.com}} is not in the allowed list, browsers block the
request, preventing the stylesheet from loading.
*Steps to Reproduce:*
# Navigate to the Atlas REST API docs:
[https://atlas.apache.org/api/v2/index.html]
# Notice the page lacks CSS styling.
# Open the browser's Developer Tools (Console/Network tab).
# Observe the CSP error blocking the load of {{{}bootstrap.min.css{}}}.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
