Skip to content

Content Security Policy (CSP)

Requirements

The minimum required CSP header for Domino Leap is:

base-uri 'none'; form-action 'self'; frame-ancestors 'self'; default-src 'none'; connect-src 'self'; font-src 'self'; script-src 'self' 'unsafe-eval' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self'; frame-src 'self';
  • Additional trusted domains for each resource type can be added as required.
  • The frame-ancestors directive can be controlled separately by the embedDomainWhitelist configuration setting. See Configuration properties > embedDomainWhitelist. If a general CSP header is also applied, the browser will merge frame-ancestors directives and enforce the least privileged setting.

Security Note: Domino Leap will not function correctly if 'unsafe-eval' and 'unsafe-inline' are omitted from the CSP header. To apply a targeted (and limited) "strict" CSP on published forms, see Strict CSP.

Setting a CSP Header

A general purpose CSP header for Domino Leap must be configured at the web server or reverse proxy layer.

For a Domino Leap installation, the CSP header can be set by configuring the Domino web engine.

Search the HCL Domino server documentation for "Web Site rules and global Web settings > HTTP response header rules"

Parent topic: Administering