[ContentSecurityPolicy]
Available since Exponential 6.0.15 (in development, not in a release yet).
Summary
The group [ContentSecurityPolicy] of settings/site.ini.
File
settings/site.ini; override it in settings/override/site.ini.append.php, in a siteaccess or in an extension.
Settings
| Setting | Default | Description |
|---|---|---|
| Mode | auto | The Content Security Policy of the pages (doc/eng-us/features/6.0/content-security-policy.md): which scripts, stylesheets, images and connections a page may use. It is sent beside the security headers of [HTTPHeaderSettings] SecurityHeaders[]. disabled: no policy report-only: Content-Security-Policy-Report-Only; the browser reports what the policy would block (developer console, ReportURI) and blocks nothing enforce: Content-Security-Policy; the browser blocks it. Sent as a second policy after SecurityHeaders[Content-Security-Policy], both apply auto (the default): report-only on administration siteaccesses (those whose [DesignSettings] SiteDesign begins with "admin"), disabled on the others |
| Directives[<key>] | default-src='self'; script-src='self'; style-src='self'; img-src='self' data: blob:; font-src='self' data:; media-src='self' blob:; connect-src='self'; worker-src='self'; frame-src='self'; object-src='none'; base-uri='self'; form-action='self'; frame-ancestors='self' | The policy, Directives[<directive>]=<sources>. Set a value empty in an override to leave that directive out; an override that starts with "Directives[]" alone replaces the whole list. Values with ";" or "," are ignored. frame-ancestors and sandbox are sent only with Mode=enforce (browsers ignore them in a report-only policy). object-src 'none' blocks <object>/<embed> (the legacy Flash, Windows Media, RealVideo and QuickTime previews, a PDF shown inline). script-src 'self' allows script files of this site only: no inline <script>, no on...= attributes, no javascript: links, no eval(). style-src 'self' allows stylesheet files only: no <style> elements and no style="" attributes (setting element.style from a script file stays allowed). |
| AdditionalSources[] | (empty array) | Sources added to a directive of Directives[], one entry per directive and sources: AdditionalSources[]=<directive> <sources>. A list, so an extension and the siteaccess can each add a host without restating the directive. An entry for a directive that Directives[] does not have is ignored. Example: AdditionalSources[]=script-src https://maps.googleapis.com |
| ReportOnlyDirectives[] | (empty array) | With Mode=enforce: a second, stricter policy sent as Content-Security-Policy-Report-Only (Directives[] with these entries in their place), to measure what it would still block while the enforced policy allows it. Empty: none. Example: ReportOnlyDirectives[style-src]='self' |
| ReportOnlyDesigns[] | admin; admin2; admin_classic | Designs whose requests stay report-only under Mode=enforce: the classic administration, with inline code, which a user can pick with the UI switch. The design of the request (after the UI switch) decides. |
| ReportOnlyViews[] | (empty array) | Views (module/view) that send a policy of their own for their own inline scripts, such as a bundled database tool: report-only under Mode=enforce, so the kernel's policy cannot block them where a server keeps both headers. Example: ReportOnlyViews[]=dse/adminneo |
| Nonce | enabled | enabled: a nonce of the request, 'nonce-...', is added to the directives of NonceDirectives[], for an inline script a template cannot move into a file: <script nonce="{csp_nonce()}">. Not added where the directive allows 'unsafe-inline' (browsers would ignore 'unsafe-inline' next to it). Never print csp_nonce() inside a cache-block or a view-cached template. |
| NonceDirectives[] | script-src | |
| ReportURI | (empty) | Where the browser sends its reports (report-uri), e.g. a collector of your own; empty: the developer console only, or with ReportEndpoint=enabled the csp/report view of the siteaccess. An absolute address is also announced as the Reporting-Endpoints endpoint csp-endpoint (report-to). |
| ReportEndpoint | disabled | enabled: with ReportURI empty, the reports go to csp/report of the siteaccess (the kernel module csp), which logs them to var/log/csp.log |
| ReportsPerMinute | 60 | The reports the view csp/report takes (one line per violation in var/log/csp.log, Setup > Log files, key csp). Per client (the salted address hash of the request classifier), per minute; over it the view answers 429 and the request classifier writes one abuse/csp-report-flood line to security.log. |
| ReportsPerMinuteTotal | 600 | All clients together, per minute. |
| MaxReportBytes | 65536 | The biggest report body taken, in bytes (413 above it). |
| MaxViolationsPerReport | 20 | The most violations written from one report (the Reporting API sends several). |
| LogFile | csp.log | The log file, in the log directory (var/log). |
See also
Generated example: site.ini [ContentSecurityPolicy]
Added to the reference for Exponential 6.0.15: the 4.x reference had no page for this group. The descriptions are the comment lines of settings/site.ini.
Contributors
- Graham Brookins Updated
Comments
Add a comment