The Content Security Policy enables you to effectively prevent cross-site scripting and other attacks aimed at infiltrating data into your web applications. You can customize the Content Security Policy settings at any time.
Required configuration keys:
To configure Content Security Policy for all web applications
-
Log in to the Administration Portal (see Logging in to the Administration Portal).
-
In the navigation, click Configuration.
-
On the Configuration page, in the Show configuration for the following API project drop-down, select the API Server API project.
-
Expand the Content security policy for HTML applications configuration parameter.
-
In the Value field, enter which settings are to be transferred to the content-security-policy header and therefore apply to the Content Security Policy.
-
Click Apply.
-
Perform one of the following actions:
-
If you want to apply the changes locally only, click Apply locally.
-
If you want to apply the changes globally, click Apply globally.
-
Click Apply.
Configure Cross-Origin Resource Sharing (CORS) to enable browsers or web clients to provide API Server content.
Required configuration keys:
-
Allowed sources of requests for CORS(CorsOrigins): Specifies which sources are allowed to access resources on the API server for Cross-Origin Resource Sharing (CORS).
-
Maximum age of preflight requests for CORS (in seconds) (CorsMaxPreflightAgeSeconds): Specifies how many seconds CORS preflight requests (Cross-Origin Resource Sharing) are valid. The browser sends a preflight request to check whether the server allows a request. After the validity period has expired, the browser sends a new preflight request.
To configure CSP for all web applications
-
Log in to the Administration Portal (see Logging in to the Administration Portal).
-
In the navigation, click Configuration.
-
On the Configuration page, in the Show configuration for the following API project drop-down, select the API Server API project.
-
Expand the Allowed request origins for CORS configuration key.
-
You can perform the following actions:
-
To add a source, click Add new and enter the source in the input field.
-
To change an existing source, change the source in the corresponding input field.
-
To remove an existing source, click on 
(delete) next to the corresponding source.
-
Expand the Maximum age of preflight requests for CORS (in seconds) configuration key.
-
In the Value input field, enter how many seconds CORS preflight requests (Cross-Origin Resource Sharing) are valid.
-
Click Apply.
-
Perform one of the following actions:
-
If you want to apply the changes locally only, click Apply locally.
-
If you want to apply the changes globally, click Apply globally.
-
Click Apply.
To protect yourself from cross-site request forgery (CSRF), you can set up different configurations.
Detailed information about this topic
To control cross-site request forgery protection (CSRF) globally, activate or deactivate it.
NOTE: One Identity recommends having CSRF protection activated at all times. To simplify development and testing in their respective environments, you can deactivate CSRF protection, as no special CSRF tokens need to be generated or checked for each request.
Required configuration keys:
To activate or deactivate CRSF protection
-
Log in to the Administration Portal (see Logging in to the Administration Portal).
-
In the navigation, click Configuration.
-
On the Configuration page, in the Show configuration for the following API project drop-down, select the API Server API project.
-
Expand the Globally disable CSRF protection tokens configuration key.
-
Perform one of the following actions:
-
To activate CSRF protection, clear the Globally disable CSRF protection tokens check box.
-
To deactivate CSRF protection, select the Globally disable CSRF protection tokens check box.
-
Click Apply.
-
Perform one of the following actions:
-
If you want to apply the changes locally only, click Apply locally.
-
If you want to apply the changes globally, click Apply globally.
-
Click Apply.
