Content-Security-Policy

A Content-Security-Policy (CSP) HTTP header provides the ability to detect and mitigate some types of attacks, including Cross-Site Scripting (XSS) and data injection attacks. It is by default set on all responses from the Spotfire Server, except for the Web Player service. If you have added custom JavaScript or CSS in a cobranding package or similar, you might need to add additional sources to the script-src and/or style-src directives. It is also possible, although discouraged, to switch off the functionality.

You can add sources with style-src, and/or script-src. To use inline scripts or sources, you can use 'unsafe-hashes' together with a hash of the script or style (see w3.org).

Run commands similar to the following example in the <server installation directory>\tomcat\spotfire-bin directory on the command line. (For details on using the Spotfire command line, see Executing commands on the command line.)

config export-config --force
config set-config-prop -n security.content-security-policy.additional-script-src -v "'unsafe-hashes' 'sha256-jzgBGA4UWFFmpOBq0JpdsySukE1FrEN5bUpoK8Z29fY='"
config set-config-prop -n security.content-security-policy.additional-style-src -v "'unsafe-hashes' 'sha256-85tSepqNWHawnJO7JXmm6IVpAXwsFPPqDeXUrDXU4X4='"
config import-config -c "Added the hash of an inline script and another style source to the Content Security Policy"

For security reasons, it is not recommended to switch of the CSP functionality, but it is possible to do so by running the following commands:

config export-config --force
config set-config-prop -n security.content-security-policy.enabled -v false
config import-config -c "Disabled Content-Security-Policy"

The feature can be switched on by running the following commands:

config export-config --force
config set-config-prop -n security.content-security-policy.enabled -v true
config import-config -c "Enabled Content-Security-Policy"

When the Content-Security-Policy header is enabled, the server includes the HTTP header "Content-Security-Policy" in all responses, except for the Web Player service. The reason for this is that the Web Player requires a more permissive policy then the rest of the system.

The current policy is logged on INFO level during startup of the server and any violations of the policy will be logged in the csp-violations.log log file.