Content Security Policy for BI Dashboard & Reporting — Say No To Unsafe JavaScript Evaluation!

Hope you’re doing well. In this blog post, I’ll describe the latest CSP updates for both DevExpress Web Reporting and BI Dashboard components.

A Content Security Policy (CSP) is an additional layer of security built into most modern browsers. The CSP defines a list of policies or directives and initial values that determine which resources your site will allow or restrict. This allows the browser to recognize and mitigate certain types of attacks, such as Cross-Site Scripting (XSS) and data injection attacks. These attacks include, but are not limited to, data theft, page spoofing, and malware distribution.

Third-party libraries we use in our code rely on runtime function evaluation. As a result, our components require that the script-src 'unsafe-eval' CSP directive operates correctly. The directive enables script execution from a string on your page. In our most recent major update (v22.2), we modified our source code to refuse script execution on the client. As such, you no longer need to specify the script-src 'unsafe-eval' CSP directive.

With this update, you’ll need to specify the following Content Security Policy directives for web pages that host our Reporting and BI Dashboard components:

Minimum required directives for Reporting

default-src 'self';
img-src data: https: http:;
script-src 'self' 'unsafe-inline';
style-src 'self' 'unsafe-inline';
worker-src 'self' blob:;
frame-src 'self' blob:

Minimum required directives for BI Dashboard

default-src 'self'; 
img-src data: https: http:;
script-src 'self' 'unsafe-inline'; 
style-src 'self' 'unsafe-inline';

Documentation

Please refer to the following help topics to learn more about Content Security Policy support in our Reporting and BI Dashboard components:

• Web Reporting - CSP
• Web Dashboard - CSP
• Dashboard for JavaScript Apps - CSP

Your Feedback Counts

Please complete the short survey below to help shape future development in this area:

Free DevExpress Products - Get Your Copy Today