Migrate CSP configuration

[mshustov]

Defines default CSP configuration.
It probably should be a part of the core HTTP service if necessary for the rendering service #41964

• Rename the CSP config path from csp to server.csp using the config deprecations from Implements config deprecation in New Platform #52251 (Move CSP options to new platform #52698 (comment))
• automatically set csp header on all HTML pages
• move legacyBrowserWarning to the csp plugin https://github.com/elastic/kibana/blob/master/src/core/public/chrome/chrome_service.tsx#L158

[elasticmachine]

Pinging @elastic/kibana-platform (Team:Platform)

[joshdover]

@Bamieh There are currently two usage collectors in the legacy kibana plugin, one for CSP and one for KQL usage. This plugin won't exist in the future (each app is being split out into its own plugin), so where do you suggest these usage collectors live?

For KQL, I think it would make sense to move it to the data plugin which owns KQL. However, for CSP, I think we should consider moving this to the OSS telemetry plugin. Reason being is that this feature is owned by Core, but we cannot have usage collectors in Core.

Thoughts?

[mshustov]

This logic also can be extracted out of chrome

if (!this.params.browserSupportsCsp && injectedMetadata.getCspConfig().warnLegacyBrowsers) {
  notifications.toasts.addWarning(
    i18n.translate('core.chrome.legacyBrowserWarning', {
      defaultMessage: 'Your browser does not meet the security requirements for Kibana.',
    })
  );
}

https://github.com/elastic/kibana/blob/master/src/core/public/chrome/chrome_service.tsx#L158

[joshdover]

@Bamieh bump on the question above regarding the CSP usage collector ^^

[joshdover]

@restrry will this be covered as part of #50654?

[mshustov]

@joshdover nope, we will set csp header on all HTML pages automatically, but renaming the config is a separate task.

[joshdover]

Ah yes forgot about the rename, should be trivial though 👍

[Bamieh]

@joshdover for some reason i had this issue on mute. Feel free to move the collector to the telemetry plugin until we find a better place for it to live at.

[pgayvallet]

CSP has been integrated to Core's http domain a while back. Closing