Content Security Policy

The Content Security Policy (CSP) feature mitigates a broad class of content injection vulnerabilities, such as cross-site scripting (XSS), by providing policy directives to compliant browsers. This feature is enabled by default. You can reconfigure the policy directives by adding entries to locked.properties.

CSP Properties for Horizon 2312 and Earlier

Property	Value Type	Primary Default	Other Defaults
enableCSP	true false	true	n/a
content-security-policy	directives-list	default-src 'self';script-src 'self' 'unsafe-inline' 'unsafe-eval' data:;style-src 'self' 'unsafe-inline';font-src 'self' data: ;frame-ancestors 'none'	admin=default-src 'self' portal=default-src 'self';script-src 'self' 'unsafe-inline' 'unsafe-eval' data:;style-src 'self' 'unsafe-inline';font-src 'self' data:;img-src 'self' data: blob:;media-src 'self' blob:;connect-src 'self' wss:;frame-src 'self' blob:;child-src 'self' blob:;object-src 'self' blob:;frame-ancestors 'self' rest=default-src 'self';script-src 'self' 'unsafe-inline' 'unsafe-eval' data:;style-src 'self' 'unsafe-inline';font-src 'self' data:;img-src 'self' data:;connect-src 'self' https:;frame-ancestors 'none'
x-content-type-options	OFF specification	nosniff	n/a
x-frame-options	OFF specification	deny	portal = sameorigin
x-xss-protection	OFF specification	1; mode=block	n/a

CSP Properties for Horizon 2406 and Later

Note: Starting with Horizon 2412, portal is excluded from the automatic application of a Content Security Policy (CSP) header to servlet responses. Instead, the portal servlet now applies its own CSP header. To customize the portal CSP header see Configure the Horizon 8 Web Portal Page for End Users for details.

Property	Value Type	Primary Default	Other Defaults
enableCSP	true false	true	n/a
content-security-policy	directives-list	broker, dct, file, health, saml, tunnel, view-vlsi = base-uri 'none';default-src 'none';form-action 'none';frame-ancestors 'none';img-src 'self';script-src 'self';style-src 'self' 'unsafe-inline'	admin = base-uri 'none';connect-src 'self' https:;default-src 'none';font-src 'self' data:;form-action 'none';frame-ancestors 'none';img-src 'self' data:;script-src 'self' 'unsafe-inline' 'unsafe-eval';style-src 'self' 'unsafe-inline' portal*, root, ws1 = base-uri 'self';child-src 'self' blob:;connect-src 'self' wss:;default-src 'none';font-src 'self';form-action 'none';frame-ancestors 'self';img-src 'self' data: blob:;media-src 'self' blob:;script-src 'self' 'unsafe-eval';style-src 'self' 'unsafe-inline' rest, view-vlsi-rest = base-uri 'none';connect-src 'self' https:;default-src 'none';font-src 'self' data:;form-action 'none';frame-ancestors 'none';img-src 'self' data:;script-src 'self';style-src 'self' 'unsafe-inline'
x-content-type-options	OFF specification	nosniff	n/a
x-frame-options	OFF specification	deny	portal = sameorigin*

* Applies to Horizon 2406 only

Example CSP Properties

You can add CSP properties to the `locked.properties` file, for example:

enableCSP = true
content-security-policy = default-src 'self';script-src 'self' 'unsafe-inline' 'unsafe-eval' data:;style-src 'self'
 'unsafe-inline';font-src 'self' data:
content-security-policy-admin = default-src 'self';script-src 'self' 'unsafe-inline' 'unsafe-eval' data:;style-src 'self'
 'unsafe-inline';font-src 'self' data:;img-src 'self' data:;connect-src 'self' https:
content-security-policy-rest = default-src 'self';script-src 'self' 'unsafe-inline' 'unsafe-eval' data:;style-src 'self' 
'unsafe-inline';font-src 'self' data:;img-src 'self' data: blob:;media-src 'self' blob:;connect-src 'self' wss:;frame-src 
'self' blob:;child-src 'self' blob:;object-src 'self' blob:
x-content-type-options = nosniff
x-frame-options = deny
x-frame-options-rest = sameorigin