Skip to main content

Official Support Articles

Search or browse our knowledge base to find answers to your questions ranging from account questions to troubleshooting error messages. The content is curated and updated by our global Support team

Announcements
QlikWorld 2023, a live, in-person thrill ride. Save $300 before February 6: REGISTER NOW!

How to determine string policy for Content Security Policy Header

cancel
Showing results for 
Search instead for 
Did you mean: 
Filippo_Nicolussi_P

How to determine string policy for Content Security Policy Header

Customer policy adopted injection via the reverse proxy of the Content Security Policy header for security reasons. 

The policy adopted is basic: default-src 'self'

Opening the QlikView AccessPoint or Qlik Sense Hub may fail or the AccessPoint may only render partially. 

The Browser Debug tools will provide more insight:

content security errors identified in debug tools.png
 

Environment:

QlikView 
Qlik Sense Enterprise on Windows 

 

The Header Content Security Option contains a string of rules that informs the browser which resource/code is trusted to be loaded, executed rendered. 

More details on the argument could be found here: 
 https://www.w3.org/TR/CSP3/ ,
 

Resolution:


For QlikView Accesspoint a first example is to use Content-Security-Policy: "default-src 'self'  'unsafe-inline' data: ;" ; (note that using 'unsafe-inline'  option could be unsafe in a the proxy injection scenario when the client will brose a different site , you could/evaluate to use instead the  sha256-hashcode version )  
Further option could be necessary if for example you have QlikView Extension Object ( Server and Document Extensions) that are using external resources downloaded from CDN locations;
In this case the troubleshoot is the same use F12/Development Tools to check the resource that violates the policy and ad an exclusion. 

 

Related Content:


QlikView Access Point Shows "Loading Content" Indefinitely,
What is CSP (Content-Security-Policy) and How does it Relate to Qlik?


 

Comments
rohitgharat
Partner - Contributor III
Partner - Contributor III

Hi @Filippo_Nicolussi_P ,

How can we implement Content Security Policy in Qliksense Enterprise version?

 

Regards,

Rohit Gharat

Sonja_Bauernfeind
Digital Support
Digital Support

Hello @rohitgharat 

I believe I already provided you with an answer to this in a different post. Copying it in here for reference:

If you are looking to add custom response headers in Qlik Sense (Enterprise on Windows), see How to add additional response headers in Qlik Sense.

Please note that we cannot advise on what headers to add.

All the best,
Sonja 

Version history
Last update:
‎2021-09-20 09:14 AM
Updated by:
Contributors