recommended policy for Content Security Policy

[dobak]

a customer of ours wants to setup Content Security Policy (CSP). i have learned that i can add that via Additional Response Headers in Qlik Sense QMC.

but i could not find any recommended policies for Qlik. does anyone have experience with this?

[Jay_Brown · Accepted solution]

Hi @dobak , In general, Content-Security-Policy is not something that Qlik has recommendations for. This is more of an environment hardening issue.

As part of best-effort, I can point you to the most relevant articles and discussions about this as there is some good info in there:

1. https://community.qlik.com/t5/Official-Support-Articles/What-is-CSP-Content-Security-Policy-and-How-... 
2. https://community.qlik.com/t5/Official-Support-Articles/How-to-add-additional-response-headers-in-Ql... 
3. https://community.qlik.com/t5/Security-Governance/Not-able-to-apply-Content-Security-Policy-on-Qliks... 
4. https://community.qlik.com/t5/Official-Support-Articles/How-to-determine-string-policy-for-Content-S... 
5. https://support.qlik.com/articles/000069349 

I will say that in the field, mistakes with this hardening can sometimes break access to the environment so it is recommended to fully research those implementations and test them in lower environments prior to deploying.

I hope that helps!