https://csp-guide.com/tags/kibana/ Recent content in Kibana on CSP Guide Hugo -- gohugo.io en-us Sun, 12 Jul 2026 00:00:00 +0000 https://csp-guide.com/posts/csp-for-elasticsearch-frontend/ Sun, 12 Jul 2026 00:00:00 +0000 https://csp-guide.com/posts/csp-for-elasticsearch-frontend/ <p>If you put Elasticsearch behind a browser-facing frontend, your Content Security Policy gets tricky fast.</p> <p>The problem usually is not Elasticsearch itself. It’s the frontend around it: Kibana, a custom React app, embedded dashboards, analytics tags, cookie banners, WebSocket connections, and a build pipeline that quietly injects inline scripts when you are not looking.</p> <p>I’ve seen teams lock down <code>default-src 'self'</code> and feel good for five minutes, then discover their search UI needs <code>connect-src</code> for the cluster API, <code>wss:</code> for live updates, and some awful third-party script exception because marketing won an argument.</p>