Content Security Policy

An attacker may try to deliver malicious scripts and inject unwanted data into your site using cross-site scripting (XSS) and data injection attacks. The browser will execute all sources from any origin without restriction, as it doesn’t know whether the source is trusted or not, and the malicious script can access any cookies, session tokens, or other sensitive information retained by the browser. Hence to secure your site from this kind of attack, the Content Security Policy has a standardized collection of directives that instruct the browser on which content sources can be allowed and which should be restricted.

How its work

The content security policy (CSP) utilizes the Content-Security-Policy response header to restrict resource loading from unknown domains, allowing resources only from the configured list of domains for each source. To restrict the execution of malicious resources, including style, script, font, image, connect, and frame sources, from other domains on your site, configure the CSP with specific directives in Bold Reports.

Do enable Content Security Policy will affect existing reports rendering

Enabling Content Security Policy (CSP) will not affect report rendering unless the resources loaded within the reports are requested from unknown domains and URLs are not excluded from the CSP settings. If you intend to load resources for your reports from an external URL, you must include that URL in the respective sources section of the CSP settings.

Content Security Policy Configuration

Configure the Content Security Policy in the Security settings under the Security section within the administration settings of Bold Reports.

The Content Security Policy is disabled by default, allowing sources from all domains without restriction. As a result, the Content-Security-Policy response header won’t be added to the request.

Enabling Content Security Policy

If you enable the Content-Security-Policy option, the Content-Security-Policy response header will be added to the request header, including the default allowed domain values for each source.

Policy configuration for Style Source

The style-src directive allows only the style sheets only URLs that are added in the Style Source field and restricts style sheets from other URLs.

The permitted URLs will be added in the Content-Security-Policy for the style source.

Content-Security-Policy: style-src 'self' https://test.boldreports.com

Policy configuration for Script Source

The script-src directive allows only the JavaScript sources from URLs that are added in the Script Source field and restricts script sources from other URLs.

The permitted URLs will be added to the Content-Security-Policy for the script source as follows.

Content-Security-Policy: script-src 'self' https://test.boldreports.com

Policy configuration for Font Source

The font-src directive allows the font sources only from URLs that are added in the Font Source field and restricts font sources from other URLs.

The permitted URLs will be added to the Content-Security-Policy for the font source as follows.

Content-Security-Policy: font-src 'self' https://test.boldreports.com

Policy configuration for Image Source

The img-src directive allows only images from URLs added in the Image Source field and restricts image sources from other URLs.

The permitted URLs will be added to the Content-Security-Policy for the image source as follows.

Content-Security-Policy: img-src 'self' https://test.boldreports.com

Policy configuration for Connect Source

The connect-src directive allows the source to make Fetch/XHR requests only from URLs added in the Connect Source field and restricts sources that make Fetch/XHR requests from other URLs.

The permitted URLs will be added to the Content-Security-Policy for the connect source as follows.

Content-Security-Policy: connect-src 'self' https://test.boldreports.com

Policy configuration for Frame Source

The frame-src directive allows the sources for the nested document to use elements such as <frame> and <iframe> only from URLs that are added in the Frame Source field, and it restricts sources from other URLs.

The permitted URLs will be added to the Content-Security-Policy for the frame source.

Content-Security-Policy: frame-src 'self' https://test.boldreports.com