Skip to main content

Managing Content Security Policy (CSP) in IBM MAS Manage

This article explores a new system property introduced in IBM MAS 8.11.0 and Manage 8.7.0+ that enhances security but can inadvertently break Google Maps functionality within Manage. We'll delve into the root cause, provide a step-by-step solution, and offer best practices for managing Content Security Policy (CSP) effectively.

Understanding the issue

IBM MAS 8.11.0 and Manage 8.7.0 introduced the mxe.sec.header.Content_Security_Policy property, implementing CSP to safeguard against injection attacks. While beneficial, its default configuration restricts external resources, causing Google Maps and fonts to malfunction.

CSP dictates which domains can serve various content types (scripts, images, fonts) to a web page. The default value in this property blocks Google-related domains by default.

Original value

font-src 'self' data: https://1.www.s81c.com *.walkme.com;
script-src 'self' 'unsafe-inline' 'unsafe-eval' *.walkme.com;
style-src 'self' 'unsafe-inline' 'unsafe-eval' *.walkme.com;
img-src 'self' d2qhvajt3imc89.cloudfront.net data: *.walkme.com;
object-src 'self' *.walkme.com;

This configuration allows resources from:

  • The same origin as the web page ('self')
  • WalkMe analytics (*.walkme.com)
  • Data embedded directly in the code (data:)

Solution

  1. Access system properties: Navigate to the "System Properties" application within Manage.

  2. Locate the property: Search for the mxe.sec.header.Content_Security_Policy property.

  3. Edit the value: Append the following domains to the relevant directives, separated by spaces: 

    font-src https://fonts.gstatic.com
    script-src https://maps.google.com https://maps.googleapis.com
    img-src https://maps.google.com https://maps.gstatic.com https://*.googleapis.com

  4. Apply changes: Save the modifications and apply them. No system restart is required.

New Value (after adding Google domains)

font-src 'self' data: https://1.www.s81c.com *.walkme.com https://fonts.gstatic.com;
script-src 'self' 'unsafe-inline' 'unsafe-eval' *.walkme.com https://maps.google.com https://maps.googleapis.com;
style-src 'self' 'unsafe-inline' 'unsafe-eval' *.walkme.com https://fonts.googleapis.com;
img-src 'self' d2qhvajt3imc89.cloudfront.net data: .walkme.com https://maps.google.com https://maps.gstatic.com https://*.googleapis.com;
object-src 'self' *.walkme.com;

Additional considerations

  • This solution specifically addresses Google Maps and fonts. For other blocked content, analyze browser console errors using Developer Tools to identify the domain and directive to update.
  • Remember, CSP serves a crucial security purpose. Only add necessary domains to mitigate specific issues. Avoid using * wildcards excessively.

Conclusion

By understanding CSP and adjusting the system property, you can restore Google Maps functionality and font display in Manage while maintaining a secure environment. Remember to follow security best practices when managing CSP.

Resources

Labels:

Comments

Post a Comment