|
4 | 4 |
|
5 | 5 | :_mod-docs-content-type: CONCEPT |
6 | 6 | [id="content-security-policy-overview_{context}"] |
7 | | -= Content Security Policy (CSP) overview |
| 7 | += Key features of Content Security Policy (CSP) |
8 | 8 |
|
| 9 | +[role="_abstract"] |
9 | 10 | A Content Security Policy (CSP) is delivered to the browser in the `Content-Security-Policy-Report-Only` response header. The policy is specified as a series of directives and values. Each directive type serves a different purpose, and each directive can have a list of values representing allowed sources. |
10 | 11 |
|
11 | | -[id="content-security-policy-key-features_{context}"] |
12 | | -== Key features of `contentSecurityPolicy` |
13 | | - |
14 | | - |
15 | | -=== Directive Types |
16 | | - |
| 12 | +[id="content-security-policy-directive-types_{context}"] |
| 13 | +== Directive Types |
17 | 14 | The supported directive types include `DefaultSrc`, `ScriptSrc`, `StyleSrc`, `ImgSrc`, and `FontSrc`. These directives allow you to specify valid sources for loading different types of content for your plugin. Each directive type serves a different purpose. For example, `ScriptSrc` defines valid JavaScript sources, while `ImgSrc` controls where images can be loaded from. |
18 | 15 |
|
19 | 16 | //backporting the ConnectSrc directive, but that is tbd - openshift/console#14701 and https://github.com/openshift/api/pull/2164 |
20 | | - |
21 | | - |
22 | | - |
23 | | -=== Values |
24 | | - |
| 17 | +[id="content-security-policy-values_{context}"] |
| 18 | +== Values |
25 | 19 | Each directive can have a list of values representing allowed sources. For example, `ScriptSrc` can specify multiple external scripts. These values are restricted to 1024 characters and cannot include whitespace, commas, or semicolons. Additionally, single-quoted strings and wildcard characters (`*`) are disallowed. |
26 | 20 |
|
27 | | - |
28 | | -=== Unified Policy |
29 | | - |
| 21 | +[id="content-security-policy-unified-policy_{context}"] |
| 22 | +== Unified Policy |
30 | 23 | The {product-title} web console aggregates the CSP directives across all enabled `ConsolePlugin` custom resources (CRs) and merges them with its own default policy. The combined policy is then applied with the `Content-Security-Policy-Report-Only` HTTP response header. |
31 | 24 |
|
32 | | - |
33 | | -=== Validation Rules |
| 25 | +[id="content-security-policy-validation-rules_{context}"] |
| 26 | +== Validation Rules |
34 | 27 | * Each directive can have up to 16 unique values. |
35 | 28 | * The total size of all values across directives must not exceed 8192 bytes (8KB). |
36 | 29 | * Each value must be unique, and additional validation rules are in place to ensure no quotes, spaces, commas, or wildcard symbols are used. |
0 commit comments