Skip to content

Content Security Policy Function

Overview

This feature allows you to configure the Content Security Policy (CSP) for Pleasanter.

Prerequisites

You need to edit the ContentSecurityPolicy parameter in the "Security.json" file in advance. For more details, please refer to Security.json. After changing the parameters, be sure to check the "Items to Confirm When Changing Parameters" section.

Content Security Policy

Content Security Policy (CSP) is a web security feature that controls which resources (such as scripts, images, and styles) can be loaded by web browsers and from where. For more information about CSP, please refer to the MDN Web Docs: Content Security Policy (CSP) Guide.

CSP Settings

If you only want to detect CSP violations, set ReportOnlyEnabled > true. When a CSP violation is detected, the details will be output to both the browser console log and the report file.
If you want to both detect CSP violations and block the loading of the offending resources, set Enabled > true. When a CSP violation is detected, the loading of the offending resource will be blocked, and the details will be output to both the browser console log and the report file.

Example of CSP Violation

The following is an example of a CSP violation when 'self' is set for ContentSecurityPolicy > Values > img-src in "Security.json".

When Enabled > true

Browser Console Log

Browser console log showing a CSP violation when Enabled is true

CSP Violation Report File 
2025-07-30 17:34:51.2576 | IP: ::1 | ContentType: application/csp-report | UserAgent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36 | body: {"csp-report":{"document-uri":"http://localhost:59802/users/login?ReturnUrl=%2F","referrer":"","violated-directive":"img-src","effective-directive":"img-src","original-policy":"default-src 'self'; script-src 'self' 'strict-dynamic' 'nonce-ddr+pcp5Pwo3r/5JusK6JA=='; script-src-attr 'self' 'unsafe-inline'; style-src 'self' 'nonce-ddr+pcp5Pwo3r/5JusK6JA=='; style-src-attr 'self' 'unsafe-inline'; style-src-elem 'self' 'unsafe-inline'; img-src 'self'; font-src 'self' data:; object-src 'none'; connect-src 'self' http://localhost:* ws://localhost:* wss://localhost:*; frame-src 'none'; base-uri 'self'; form-action 'self'; report-uri /CspReport/Report;","disposition":"enforce","blocked-uri":"data","line-number":2,"column-number":51704,"source-file":"http://localhost:59802/assets/plugins/jquery-3.6.0.min.js","status-code":200,"script-sample":""}}
2025-07-30 17:34:51.2576 | IP: ::1 | ContentType: application/csp-report | UserAgent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36 | body: {"csp-report":{"document-uri":"http://localhost:59802/users/login?ReturnUrl=%2F","referrer":"","violated-directive":"img-src","effective-directive":"img-src","original-policy":"default-src 'self'; script-src 'self' 'strict-dynamic' 'nonce-ddr+pcp5Pwo3r/5JusK6JA=='; script-src-attr 'self' 'unsafe-inline'; style-src 'self' 'nonce-ddr+pcp5Pwo3r/5JusK6JA=='; style-src-attr 'self' 'unsafe-inline'; style-src-elem 'self' 'unsafe-inline'; img-src 'self'; font-src 'self' data:; object-src 'none'; connect-src 'self' http://localhost:* ws://localhost:* wss://localhost:*; frame-src 'none'; base-uri 'self'; form-action 'self'; report-uri /CspReport/Report;","disposition":"enforce","blocked-uri":"data","status-code":200,"script-sample":""}}

When ReportOnlyEnabled > true

Browser Console Log

Browser console log showing a CSP violation when ReportOnlyEnabled is true

CSP Violation Report File 
2025-07-30 17:26:45.0399 | IP: ::1 | ContentType: application/csp-report | UserAgent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36 | body: {"csp-report":{"document-uri":"http://localhost:59802/users/login","referrer":"http://localhost:59802/","violated-directive":"img-src","effective-directive":"img-src","original-policy":"default-src 'self'; script-src 'self' 'strict-dynamic' 'nonce-0dFRrHOEwmad01cIBlHpOQ=='; script-src-attr 'self' 'unsafe-inline'; style-src 'self' 'nonce-0dFRrHOEwmad01cIBlHpOQ=='; style-src-attr 'self' 'unsafe-inline'; style-src-elem 'self' 'unsafe-inline'; img-src 'self'; font-src 'self' data:; object-src 'none'; connect-src 'self' http://localhost:* ws://localhost:* wss://localhost:*; frame-src 'none'; base-uri 'self'; form-action 'self'; report-uri /CspReport/Report;","disposition":"report","blocked-uri":"data","line-number":2,"column-number":51704,"source-file":"http://localhost:59802/assets/plugins/jquery-3.6.0.min.js","status-code":200,"script-sample":""}}
2025-07-30 17:26:45.0462 | IP: ::1 | ContentType: application/csp-report | UserAgent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36 | body: {"csp-report":{"document-uri":"http://localhost:59802/users/login","referrer":"http://localhost:59802/","violated-directive":"img-src","effective-directive":"img-src","original-policy":"default-src 'self'; script-src 'self' 'strict-dynamic' 'nonce-0dFRrHOEwmad01cIBlHpOQ=='; script-src-attr 'self' 'unsafe-inline'; style-src 'self' 'nonce-0dFRrHOEwmad01cIBlHpOQ=='; style-src-attr 'self' 'unsafe-inline'; style-src-elem 'self' 'unsafe-inline'; img-src 'self'; font-src 'self' data:; object-src 'none'; connect-src 'self' http://localhost:* ws://localhost:* wss://localhost:*; frame-src 'none'; base-uri 'self'; form-action 'self'; report-uri /CspReport/Report;","disposition":"report","blocked-uri":"data","status-code":200,"script-sample":""}}

Storage Location of CSP Violation Report Files

In the standard configuration, CSP violation report files are stored in the following directories:

Environment Storage Location
Windows C:\web\pleasanter\Implem.Pleasanter\Logs
Linux /web/pleasanter/Implem.Pleasanter/Logs
Microsoft Azure .\Implem.Pleasanter\Logs

CSP Violations During Development

When Pleasanter is launched from Visual Studio, the following CSP violations may appear in the browser console log, but will not be output to the CSP violation report file.

  • Refused to load the script 'http://localhost:XXXXX/_vs/browserLink' because ・・・
  • Refused to load the script 'http://localhost:XXXXX/_framework/aspnetcore-browser-refresh.js' because ・・・
Browser Console Log (ReportOnlyEnabled > true)

Browser console log of the CSP violations seen when starting from Visual Studio

These CSP violations occur because Visual Studio automatically adds them to the HTML source code for debugging purposes. They are not added to the HTML source code outside of development with Visual Studio.

Supported Versions

Version Details
1.4.19.0 or later Feature added