CSP directive reference

The CSP directive reference covers every directive field available in Document360's Content Security Policy settings, along with best practices for configuring them, methods for testing your policy, and guidance for troubleshooting blocked resources. Use this reference after you have enabled CSP and are ready to configure or validate your policy.

CSP directive groups

CSP settings in Document360 are organised into four groups. All fields accept comma-separated domain URLs in the format https://example.com.

Code policy

This group governs the sources from which code and styling resources are loaded. The Default source directive acts as a fallback for any resource type that does not have a more specific rule defined.

Resource control

This group controls which external domains are allowed to supply media and data resources such as images, fonts, API calls, and background worker scripts.

Embedding & Security

This group controls how your Knowledge Base embeds external content and how it can itself be embedded on other websites. It is particularly important for preventing clickjacking attacks and managing third-party content such as videos, widgets, and portals.

Reporting

The Reporting group instructs browsers to send violation reports to a designated endpoint whenever a resource is blocked by your policy. This is essential for identifying misconfigurations and potential attack attempts without disrupting your site.

Best practices

• Start with a restrictive default — Set Default source to 'self' first. This creates a secure baseline where only resources from your own domain are allowed unless explicitly permitted elsewhere. Add specific domains in targeted fields rather than broadening Default source.

• Use specific directives instead of broad allowlists — Rather than adding many domains to Default source, use the targeted fields: Script source, Frame source, Connect source, and so on. This keeps the policy easier to maintain and reduces accidental overexposure.

• Use reporting before enforcing — Configure Report endpoint first so you can monitor blocked resources before the policy affects your readers. Review violation reports for several days or weeks before tightening the policy.

• Use nonce for custom inline scripts — Always use the {{Document360-Nonce}} placeholder in custom HTML script sections. This allows trusted inline scripts to run securely without using 'unsafe-inline', which would undermine your entire script policy.

How to test your Content Security Policy

After configuring and saving your CSP settings, verify that the policy is working as expected using one of the following methods.

Method 1: Via page source

1. Open your Knowledge Base site in a browser.
2. Right-click anywhere on the page and select View page source.
3. Press Ctrl+F (Windows) or Cmd+F (Mac) and search for Content-Security-Policy.
4. If found, the full CSP configuration appears next to this term, confirming it is active.

Method 2: Via browser developer tools

1. Open your browser's developer tools (F12 or right-click > Inspect).
2. Navigate to the Network tab.
3. Visit your Knowledge Base and select any page request.
4. Review the page HTML for the CSP meta tag.

Method 3: Via online tools

You can also use external tools such as securityheaders.com to analyse your site's security configuration. Since Document360 uses a meta element rather than a response header, some tools may report CSP as absent at the header level — this is expected.

Common issues

Video shows as 'This content is blocked' in one article but not another

The domain serving the video is not in your Frame source allowlist, or the domain differs between embed types (for example, https://www.youtube.com for standard embeds vs https://www.youtube-nocookie.com for privacy-enhanced embeds). Add both to Frame source.

Custom font displays incorrectly or falls back to system font

Font providers typically use two different domains — one for the CSS stylesheet and one for the actual font files. Both must be listed. For Google Fonts, add https://fonts.googleapis.com to Style source and https://fonts.gstatic.com to Font source.

Chat widget loads but doesn't function

Chat widgets often load scripts, make API calls, and load images from multiple domains. Check the browser console for all blocked requests — there may be several. Add all required domains to the appropriate directive fields (Script source, Connect source, Image source).

Form submission is blocked

If a form on your Knowledge Base submits to an external service, add that service's domain to the Form action field.

Violation reports are not arriving at the Report endpoint

Verify that:

• The endpoint URL is publicly reachable (not behind a VPN or firewall).
• The endpoint accepts POST requests and returns a 2xx response.
• The endpoint supports the Content-Type: application/csp-report request format.
• If using the Report to directive, the named reporting group is correctly configured in your infrastructure.

CSP validation tool reports CSP as missing

Document360 implements CSP via a meta element in the page source, not via an HTTP response header. Tools that only check response headers will report CSP as missing. To confirm CSP is enabled, view the page source and search for Content-Security-Policy.

Browser differences

Most modern browsers (Chrome, Firefox, Edge, Safari) support the CSP meta element. Known differences:

• frame-ancestors is ignored when delivered via a meta element in some older browser versions. If frame embedding protection is critical, also enable X-Frame Protection.
• Safari may handle some CSP directives differently from Chrome and Firefox. Test your configuration in Safari if your users are on Apple devices.
• Very old browsers (Internet Explorer 11 and below) do not support CSP. If you have IE11 users, CSP will be silently ignored.

FAQ

{
  "csp-report": {
    "document-uri": "https://docs.yourcompany.com/article",
    "violated-directive": "script-src 'self'",
    "blocked-uri": "https://cdn.example.com/widget.js",
    "original-policy": "default-src 'self'; script-src 'self'"
  }
}