This page applies to Apigee and Apigee hybrid.
View
Apigee Edge documentation.
Configure a content security policy (CSP) for all pages in your portal to protect against cross-site scripting (XSS) and other code-injection attacks. The CSP defines trusted sources for content such as scripts, styles, and images. After configuring a policy, content loaded from untrusted sources will be blocked by your browser.
The CSP is added as a Content-Security-Policy HTTP response header to all pages in your portal, as follows:
Content-Security-Policy: policy
You define the policy using directives, as defined in Content Security Policy Directives in the W3C site.
If you enable the CSP header, by default the following CSP directive is defined:
default-src 'unsafe-eval' 'unsafe-inline' * data:
The default-src directive configures the default policy for resource types that do not have a configured directive.
The following table describes the policies defined as part of the default directive.
| Policy | Access |
|---|---|
'unsafe-inline' |
Inline resources, such as inline <script> elements, javascript: URLs, inline event handlers, and inline <style> elements. Note: You must enclose the policy in single quotes. |
'unsafe-eval' |
Unsafe dynamic code evaluation such as JavaScript eval() and similar methods used to create code from strings. Note: You must enclose the policy in single quotes. |
* (wildcard) |
Any URL except data:, blob:, and filesystem: schemes. |
data: |
Resources loaded via the data scheme (for example, Base64-encoded images). |
The following provides examples of configuring the CSP to restrict specific resource types.
| Policy | Access |
|---|---|
default-src 'none' |
No access for resource types that do not have a configured directive. |
img-src * |
Image URL from any source. |
media-src https://example.com/ |
Video or audio URL over HTTPS from the example.com domain. |
script-src *.example.com |
Execution of any script from a subdomain of example.com. |
style-src 'self' css.example.com |
Application of any style from the site's origin or the css.example.com domain. |
To configure a content security policy:
- Select Publish > Portals and select your portal.
- Select Settings in the drop-down menu in the top navigation bar.
- Alternatively, click Settings on the portal landing page.
- Click the Security tab.
- Click Enable content security policy.
- Configure the CSP or leave the default.
- Click Save.
You can restore the default CSP policy at any time by clicking Restore default.