Issue

On opening the web portal of Constellation application, a blank screen is displayed.

Symptoms and Impact

The following screenshot shows the console errors when the issue occurs:

Steps to reproduce

1. Create a Constellation application.
2. Configure the DSS ConstellationPegaStaticURL with the value: https://release.constellation.pega.com:
3. Configure the Content Security Policy (CSP) of Constellation application in its application definition rule and select the option Reject and Report.
4. Launch the web portal.

Root cause

This behavior is consistent with the current design of Pega code or rules.
When a website attempts to load a resource, such as a script, image or stylesheet, that is not explicitly allowed by its Content Security Policy (CSP), a CSP error occurs. This means the browser blocks the resource due to the security restrictions set by the website owner, causing an error message in the developer console.

In a Constellation application, this issue occurs when the CSP is explicitly set to Reject and Report in Application rule (as shown in the following screenshot).

In the DSS ConstellationPegaStaticURL, https://release.constellation.pega.com is being used. This URL domain is different from the platform domain.  As a result, the CSP interprets the resource from the unexpected domain as a violation of its rules, leading to a CSP error.

Solution

To avoid CSP errors, perform the following steps to add the ConstellationPegaStaticURL value to the trusted URLs:

1. Perform a SaveAs of an OOTB CSP rule to custom ruleset and make the following changes in the CSP rule.
   1. In the Image-Source dialog box, select the checkbox for Self. In the Allowed Websites field, add the ConstellationPegaStaticURL value. Refer to the following image:
      
   2. In the Script-Source dialog box, select the checkbox for Self. In the Allowed Websites field, add the ConstellationPegaStaticURL value.
   3. In Style-Source dialog box, select the checkbox for Self. In the Allowed Websites field, add the ConstellationPegaStaticURL value.
   4. In Connect-Source dialog box, select the checkbox for Self. In the Allowed Websites field, add the ConstellationPegaStaticURL value.

Environment

All Pega Platform^TM versions.

References

• CSP settings Constellation