Adding a CSP feature to Kibana 7.6.2 Login is failed

[gnana03]

Kibana version: 7.6.2

Server OS version: Ubuntu 18.04

Browser version: Chrome

Browser OS version: 84.04

Original install method (e.g. download page, yum, from source, etc.): Helm Charts

Description of the problem including expected versus actual behavior:

Steps to reproduce:

1. Included below annotation for kibana security headers
   nginx.ingress.kubernetes.io/configuration-snippet: |
   more_set_headers "X-Content-Type-Options: 'nosniff'";
   more_set_headers "X-Frame-Options: SAMEORIGIN";
   more_set_headers "Content-Security-Policy: script-src 'self'";
   more_set_headers "X-XSS-Protection: 1; mode=block";
2. Login into Kibana after deploying the change

Errors in browser console (if relevant):
Definition of plugin "data" should be a function (/bundles/plugin/data.bundle.js).
Version: 7.6.2
Build: 29199
Error: Definition of plugin "data" should be a function (/bundles/plugin/data.bundle.js).
at HTMLScriptElement.script.onload
Provide logs and/or server output (if relevant):

Describe the feature:
By adding a CSP feature to Kibana 7.6.2 Login is failed showing below attached error.

Definition of plugin "data" should be a function (/bundles/plugin/data.bundle.js).
Version: 7.6.2
Build: 29199
Error: Definition of plugin "data" should be a function (/bundles/plugin/data.bundle.js).
at HTMLScriptElement.script.onload

[elasticmachine]

Pinging @elastic/kibana-platform (Team:Platform)

[elasticmachine]

Pinging @elastic/kibana-security (Team:Security)

[jportner]

This is not a bug. Kibana ships with this Content-Security-Policy by default: script-src 'unsafe-eval' 'self'; worker-src blob:; child-src blob:; style-src 'unsafe-inline' 'self'

You are using a reverse proxy to override this response header with a stricter policy, but Kibana needs this minimal set of directives to operate.

script-src 'unsafe-eval' in particular is undesirable, but it is currently required due to third party dependencies, which includes (but is not limited to) Angular.

You can keep an eye on these issues that are currently open to enhance Kibana's default CSP:

• CSP unsafe-eval auditing #36311
• Client-side unsafe-eval Sandbox #27047
• CSP default-src 'self' #56996

[gnana03]

Thanks @jportner for detailed explanation!