Settings options of Content Security Policy in Application Tab
In the Application rule's security tab there are two options(radio button) for security policy a. Reject and Report b. Report Only.
Can anyone let me know the significance of these both. (after selecting Reject and Report I was not able to load the first screen after log-in)
In our current application(upgraded recetly to Pega8.6) we are making changes in Script-Sources (only selecting Self and Data) and Frame-Ancestors (selecting Self ) by saving as Pega provided security policy pxDefaultAllowAll (which has Allow-all selected ) in order to prevent Potential ClickJacking and Insecure CSP Configuration.
Coforge DPA
IN
@AradhanaM The value selected for Mode of content security policy derives whether to enforce the policy, or to merely report usage of the policy:
- Reject and report – Enforce the policy
- Report only – Report, but do not enforce the policy
also refer to article https://academy.pega.com/topic/content-security-policies/v3