Loading ...

Content Security Policy (CSP) | Axero Documentation

Home » axero documentation » Wiki » Documentation » Compliance » Content Security Policy (CSP)
Axero Documentation  Wiki
Public Space
Activity Stream Content
Version 11

Content Security Policy (CSP)

0 
 /5
0 (0votes)

Applies to: Cloud & Self-Hosted

Audience: Site Administrators

Time: Approximately 10 minutes

Introduction

This guide explains what Content Security Policy (CSP) is, which Axero platform features it affects, and how to configure it using the ContentSecurityPolicy system property.

Important: Axero does not provide a default Content Security Policy. Each organization is responsible for defining a policy that meets its own security requirements.

Overview

What Content Security Policy Protects

Content Security Policy (CSP) is a security standard that controls which external sources your Axero platform can load resources from. If a resource originates from a source that is not in the CSP allowlist, the browser blocks it.

CSP protects against content injection attacks such as Cross-Site Scripting (XSS). Administrators can reduce risk by specifying an allowlist of trusted sources for scripts, stylesheets, images, fonts, and other resources.

The following Axero platform features access external resources and can be affected by your CSP configuration:

Tip: Review each feature above to identify which external domains it requires, then include those domains in your CSP allowlist.

Configure Content Security Policy

The ContentSecurityPolicy system property allows you to define CSP directives directly through system configuration. Use it to specify which resources are allowed to load and execute on your Axero platform pages.

  1. Navigate to Control Panel > System > System Properties.
  2. Locate the ContentSecurityPolicy property.
  3. Enter your CSP directives as a semicolon-separated list. For example, to allow scripts only from your own domain and a trusted third-party domain, enter:
    script-src 'self' https://trusted-source.example.com;
    ContentSecurityPolicy system property field showing an example CSP directive
  4. Select Save.

Note: Changes to the ContentSecurityPolicy system property take effect immediately. Test your policy in a staging environment before applying it to production to avoid accidentally blocking required resources.

Common Use Case: Allowing Iframe Embedding

If your organization embeds the Axero platform inside an iframe on another site (for example, a company portal or dashboard), the browser will block the embed by default. To allow it, add a frame-ancestors directive that lists the embedding domain:

frame-ancestors 'self' https://portal.example.com;

Replace https://portal.example.com with the actual URL of the site that will embed your Axero platform in an iframe. You can list multiple domains separated by spaces.

Important: Axero sets X-Frame-Options: SAMEORIGIN by default, site-wide. That is why another site cannot embed your pages until you configure a CSP frame-ancestors directive.

You do not need to change or remove that header. In modern browsers a Content Security Policy with frame-ancestors supersedes X-Frame-Options, so adding the CSP is the supported way to allow embedding.

Keep 'self' in the list. frame-ancestors is an allowlist, not an addition to what is already permitted. List only external domains and you have told the browser your own site may not frame its own content, which breaks internal embeds such as Files, Spaces and embedded pages with Refused to frame ... because an ancestor violates ... frame-ancestors. Leave 'self' in unless you deliberately intend to stop that.

Verify Your Configuration

After saving your Content Security Policy, verify that it works as expected.

Testing Iframe Embedding

If you configured frame-ancestors, verify the directive by attempting to embed your Axero platform in an iframe on the allowed domain. If the embed loads successfully, the directive is working. If the browser blocks it, open the browser developer console (F12) and look for a CSP violation error referencing frame-ancestors.

Tip: To test quickly, you can use a free tool such as iframetester.com. Enter your Axero platform URL to confirm whether iframe embedding is allowed or blocked. Add the testing tool's domain to your frame-ancestors directive temporarily during testing, then remove it when finished.

Testing Other Directives

For directives such as script-src or style-src, open the browser developer console (F12) on your Axero platform and look for CSP violation errors. Blocked resources will appear as errors referencing the directive that blocked them. Verify that expected resources load and that no critical platform functionality is broken.

Additional Resources

For a comprehensive overview of CSP directives and syntax, see the Content Security Policy (CSP) reference on MDN Web Docs.

For practical guidance on implementing CSP to harden your web security, see Improving Web Security with the Content Security Policy on SitePoint.

Support and Feedback

We are always working to improve our documentation. If you encounter an issue not covered here, or if a step could be clearer, let us know through a Support Case so we can help you and improve this guide for everyone.

Wiki Index

Pages