How do we resolve, "This application's Content Security Policy on the Integration tab has been left blank. It is recommended to use a default policy or create your own prior to migrating to a production environment."?
This is information warning in application rule.
Pegasystems Inc.
US
I am assuming that the application in question is going to be used in production. If so, I would encourage you to develop a customized content security policy rather than using pxDefaultAllowAll to make the warning go away. A content security policy will help to reduce your exposure to a variety of security threats by limiting the content in your application to only the sources that you white list.
Pegasystems Inc.
US
Gyan,
Probably the best first stop on learning about content security policy is the wikipedia article (Content Security Policy - Wikipedia, the free encyclopedia). You will notice that the article quickly goes into technical detail, fortunately the content security policy rule allows you to avoid having to deal with the details and focus on the setting up your white lists for content sources. A good source on setting up a Content Security Policy is the PRPC help (which you can also get through the PDN at https://community.pega.com/sites/default/files/help_v72/procomhelpmain.htm).
Matt
StratosphereTC
US
Hi Matt,
Ours is a 7.1.5 application. Can you tell us how we can create a Content Security Policy in Pega 7.1.5?
Many thanks in advance!
Geeta
Pegasystems Inc.
US
Hi Geeta,
Content Security Policy was not introduced in Pega until 7.1.6. I would suggest that you look at this reference for adding a policy via your load balancer or web server: https://content-security-policy.com/
Telstra
AU
Assuming most of the Pega Apps are in internal network, it'd be nice to know which OOTB Content Security Policy rule we can use so that we don't have to customize.
Pegasystems Inc.
US
Hi Abhijith,
Pega 7 comes with 2 Content Security Policies out of the box: pxDefaultAllowAll and pxDefaultSecured. You can open up those rules and review the policies in place for each. On the application rule you can defined to reject and report or report only. You may consider setting the policy to report only for each to see what the headers that get specified are on the response. Then you can review and determine which on to put in place. https://community.pega.com/sites/default/files/help_v722/procomhelpmain.htm