How to Implement a Content Security Policy (CSP) Header

Introduction

Content Security Policy (CSP) is a modern security standard that helps prevent attacks such as Cross-Site Scripting (XSS) by defining which resources a webpage is allowed to load.

By default, Joget does not implement any CSP header, because CSP requirements differ between deployments. Instead, Joget leaves it to the web server or reverse proxy (e.g., Nginx, Apache, Cloudflare, AWS ALB) to define CSP headers based on your security needs.

If you decide to enable CSP, you must ensure the policy does not break Joget’s functionality. This is because Joget apps frequently load:

• Built-in JS/CSS libraries
• Custom HTML code
• Beanshell and custom JavaScript functions
• Third-party API calls
• AJAX requests made via JSON API tools

Therefore, all domains, APIs, resources, and scripts used by your Joget apps must be whitelisted inside the CSP header. Otherwise, parts of your app UI or custom logic may stop working.

Implementing CSP Header (Web Server Examples)

Steps vary depending on your web server or reverse proxy setup.
Below are sample configurations.

1. Nginx Example:

   server {
       listen 80;
       server_name your-domain.com;
   
   
       location / {
           proxy_pass http://local-host:8080;  # Tomcat
           proxy_set_header Host $host;
           
           # Add CSP header
           add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'; connect-src 'self'; frame-src 'self'; object-src 'none'; child-src 'none';" always;
       }
   }

2. Apache VirtualHost Example:
   

   <VirtualHost *:80>
       ServerName your-domain.com
       DocumentRoot /var/www/html
   
       # Add Content-Security-Policy header
       Header set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'; connect-src 'self'; frame-src 'self'; object-src 'none'; child-src 'none';"
   
       # Other site configurations (e.g., ProxyPass, etc.)
   </VirtualHost>

3. Apache .htaccess Example:
   

   Header set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'; connect-src 'self'; frame-src 'self'; object-src 'none'; child-src 'none';"

Configure CSP Header Filter using Plugin 

To use the ContentSecurityPolicyHeaderFilter only for Joget, follow these steps:

1. Download the filter jar file here: content-security-policy-filter.jar.
2. Copy the JAR to Joget's WEB-INF/lib Directory.
3. Configure the Filter in the Joget's web.xml by adding the following configuration (located in $TOMCAT_HOME/webapps/jw/WEB-INF/web.xml):
   

   <filter>
       <filter-name>ContentSecurityPolicyHeaderFilter</filter-name>
       <filter-class>org.joget.ContentSecurityPolicyHeaderFilter</filter-class>
       <init-param>
           <param-name>value</param-name>
           <param-value>
               default-src 'self'; connect-src 'self' wss:; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'; frame-src 'self'; object-src 'none'; child-src 'none';
           </param-value>
       </init-param>
   </filter>
   <filter-mapping>
       <filter-name>ContentSecurityPolicyHeaderFilter</filter-name>
       <url-pattern>/*</url-pattern>
       <async-supported>true</async-supported>
   </filter-mapping>

4. Restart Tomcat.
5. Verify CSP Header by using curl and look for the Content-Security-Policy header in the response:
   

   curl -I http://your-joget-server/jw