Skip to content

Content Security Policy (CSP)

Requirements

The minimum required CSP header for Leap is:

base-uri 'none'; form-action 'self'; frame-ancestors 'self'; default-src 'none'; connect-src 'self'; font-src 'self'; script-src 'self' 'unsafe-eval' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self'; frame-src 'self';
  • Additional trusted domains for each resource type can be added as required.
  • The frame-ancestors directive can be controlled separately by the embedDomainWhitelist configuration setting. See Configuration properties > embedDomainWhitelist. If a general CSP header is also applied, the browser will merge frame-ancestors directives and enforce the least privileged setting.

Security Note: Leap will not function correctly if 'unsafe-eval' and 'unsafe-inline' are omitted from the CSP header. To apply a targeted (and limited) "strict" CSP on published forms, see Strict CSP.

Setting a CSP Header

A general purpose CSP header for Leap must be configured at the web server or reverse proxy layer.

For an IBM WebSphere Application Server (WAS) installation, the CSP header can be set using the following configuration in IBM HTTP Server (IHS) 

<Location /apps>
  Header always set Content-Security-Policy "<CSP header>"
</Location>

For a Helm/Kubernetes deployment, refer to your ingress controller's documentation on setting response headers. For example, if you are using Traefik as your ingress controller, you can set the CSP header using the Traefik headers middleware for your Ingress resource.

Example: 

extraObjects:
  - apiVersion: traefik.io/v1alpha1
    kind: Middleware
    metadata:
      name: leap-csp-headers
    spec:
      headers:
        customResponseHeaders:
          Content-Security-Policy: "<CSP header>"
  - apiVersion: networking.k8s.io/v1
    kind: Ingress
    metadata:
      name: leap
      annotations:
        traefik.ingress.kubernetes.io/router.middlewares: "\{\{ .Release.Namespace \}\}-leap-csp-headers@kubernetescrd"
    spec:
      ingressClassName: traefik
      rules:
        - host: leap.example.com
          http:
            paths:
              - path: /apps
                pathType: Prefix
                backend:
                  service:
                    name: "\{\{ .Release.Namespace \}\}-leap"
                    port:
                      number: 9443
      ...

Parent topic: Administering