Configure CSP

Hi

Using V2025.4

I have recently upgraded from V2023.x

I have a custom page which embeds content from a different site using an IFrame

This worked fine in V2023.x but since upgrading it no longer works it just says

“This content is blocked. Contact the site owner to fix the issue”

I assume its the Content Security Policy (CSP) blocking this - just have no idea where to start

Can CSP be disabled to test if that’s the issue

Kind Regards
John B

For better security of your site, you better configure CSP instead of disabling it. You may turn it off by CSP though.

Hey John,

As Arbei says, it is better to keep it in place. Especially if it is a public facing system. The script kiddies are only getting smarter.

In essence it’s a pretty simple setup.
The key is to put something like this

Config()->append(“CSP.img-src.allow”, “https://quickchart.io”);

in “Global Code”. (Don’t put any comments etc. They get interpreted as well while updating the config for CSP)

The command is the first parameter and in particular the middle part of the parameter, in this case “img-src”.

In the example above “CSP.img-src.allow
CSP - Control marker
img-src - the directive
allow - the action.

This basically means allow images to be loaded from the site which is the second parameter “https://quickchart.io”.

All the directives can be viewed at Content-Security-Policy - HTTP | MDN

If your not sure which one your after there is a “default-src” which is a catchall and allows any type of reference from the specified site.

Hi

Thanks, very helpful

Kind Regards
John B

Hi arataki

So been trying but not to much success (yet)

I want to embed a page generated on a diffeent server

So I think I need something like

Config()->append(“CSP.default-scr.allow”, “the URL its coming from");

Kind Regards
John B

You may want to see CSP: frame-src.

Hi sorry

Really struggling with this

I have tried this in Global Code

Config()->append(“CSP.frame-scr.allow”, “the url where the page is”);

and this

Config()->append(“CSP.default-scr.allow”, “the url where the page is”);

Help Appreciated

Kind Regards
John B

Just a thought. Is CSP switched on in Advanced Settings?

Also note, if you cut and pasted the original command from here, replace the quotes. The format you have looks fine.

Here’s my Global Code in a project I have and it works no probs.

Press F12 in your browser, go to the Console panel to check the errors and find the correct directive that you should set for CSP.

Hi

So F12 reveals this

I added this to Global Code

code

but its still blocked

is my syntax correct for the line in global code ?

Kind Regards
John B

Double check the spelling of the directive in your code.

It should be frame-src instead of frame-scr.

1 Like

Not CSP.frame-scr, but CSP.frame-src instead

thanks so much apologies for the lengthy thread

Kind Regards
John B