{"type":"doc","content":[{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"paragraph","content":[{"text":"This requires developer level understanding of security headers and Content Security Policy (CSP) directives. Modifying a CSP without understanding its impact can break the functionality of Engaging Networks pages.","type":"text"}]}]},{"type":"paragraph","content":[{"text":"A Content Security Policy (CSP) is a security header that can be used to enhance the security of a web page by dictating what assets (e.g., script files, CSS files, etc) can be loaded on it. It is a best practice to use a CSP on all web pages and one can be used to meet PCI or other regulatory requirements such as script authorization and integrity. This feature allows Super Admins to enable a CSP on their Engaging Networks pages (except peer to peer pages) and to use either an Engaging Networks predefined policy or define their own. ","type":"text"}]},{"type":"panel","attrs":{"panelType":"note"},"content":[{"type":"paragraph","content":[{"text":"The CSP for peer to peer pages is defined differently. ","type":"text"},{"text":"Read more here.","type":"text","marks":[{"type":"link","attrs":{"href":"https://ensupportal.atlassian.net/wiki/spaces/softwaresecurityandprivacy/pages/edit-v2/530907139#Peer-to-Peer-CSP"}}]}]}]},{"type":"mediaSingle","attrs":{"layout":"center","width":760,"widthType":"pixel"},"content":[{"type":"media","attrs":{"width":1397,"alt":"image-20250218-173944.png","id":"5197c107-7080-4a96-8767-7b6e0b6bf09c","collection":"contentId-530907139","type":"file","height":291}}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"How to access Content Security Policies","type":"text"}]},{"type":"paragraph","content":[{"text":"The Content Security Policies are available to Super Admins by navigating to ","type":"text"},{"text":"Hello > Security Center > Content Security Policies","type":"text","marks":[{"type":"strong"}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Options for Enabling Content Security Policies","type":"text"}]},{"type":"heading","attrs":{"level":4},"content":[{"text":"No policy","type":"text"}]},{"type":"paragraph","content":[{"text":"The default behavior for all accounts if no policy has been enabled. There will be a message at the top of the CSP area indicating there is no enabled CSP.","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"center","width":371,"widthType":"pixel"},"content":[{"type":"media","attrs":{"width":371,"alt":"image-20250218-201612.png","id":"3008a2d3-7cde-4558-ad16-6d71a60fed6c","collection":"contentId-530907139","type":"file","height":52}}]},{"type":"heading","attrs":{"level":4},"content":[{"text":"Engaging Networks (Standard)","type":"text"}]},{"type":"paragraph","content":[{"text":"This option uses an Engaging Networks defined CSP. It is designed to be a stricter policy that prevents inline script injection using nonce (“number used once”).","type":"text"}]},{"type":"paragraph","content":[{"text":"The","type":"text"},{"text":" Applicable Content Security Policy ","type":"text","marks":[{"type":"strong"}]},{"text":"allows you to preview the CSP as it will be applied to your Engaging Networks pages. The Engaging Networks defined CSP includes all core Engaging Networks resources. Please see directives and allowed sources below to better understand how the Engaging Networks CSP is defined and how it works.","type":"text"}]},{"type":"heading","attrs":{"level":4},"content":[{"text":"Define your own","type":"text"}]},{"type":"paragraph","content":[{"text":"This option allows you to define your own CSP. Select ","type":"text"},{"type":"mediaInline","attrs":{"width":116,"alt":"image-20250218-190818.png","id":"bfb18444-aa6b-4d7a-a69a-64c512a4ebf5","collection":"contentId-530907139","type":"image","height":23}},{"text":" to begin adding elements to your defined CSP. See a list of available directives and what they control along with examples of allowed sources below.","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"center","width":760,"widthType":"pixel"},"content":[{"type":"media","attrs":{"width":1305,"alt":"image-20250218-193533.png","id":"503f5866-05e8-4bfc-904f-cbfdc933fcf3","collection":"contentId-530907139","type":"file","height":85}}]},{"type":"table","attrs":{"layout":"default","width":760.0,"localId":"978e2397-67fa-4690-82c2-5c61fd2ee8b3"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[209.0]},"content":[{"type":"paragraph","content":[{"text":"Available Directive","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[547.0]},"content":[{"type":"paragraph","content":[{"text":"What it controls","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[209.0]},"content":[{"type":"paragraph","marks":[{"type":"alignment","attrs":{"align":"center"}}],"content":[{"text":"default-src","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[547.0]},"content":[{"type":"paragraph","content":[{"text":"Specifies the default policy for fetching resources if no other directive matches.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[209.0]},"content":[{"type":"paragraph","marks":[{"type":"alignment","attrs":{"align":"center"}}],"content":[{"text":"img-src","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[547.0]},"content":[{"type":"paragraph","content":[{"text":"Controls where images can be loaded from.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[209.0]},"content":[{"type":"paragraph","marks":[{"type":"alignment","attrs":{"align":"center"}}],"content":[{"text":"script-src","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[547.0]},"content":[{"type":"paragraph","content":[{"text":"Controls where JavaScript can be loaded and executed from.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[209.0]},"content":[{"type":"paragraph","marks":[{"type":"alignment","attrs":{"align":"center"}}],"content":[{"text":"style-src","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[547.0]},"content":[{"type":"paragraph","content":[{"text":"Controls where CSS stylesheets can be loaded from.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[209.0]},"content":[{"type":"paragraph","marks":[{"type":"alignment","attrs":{"align":"center"}}],"content":[{"text":"connect-src","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[547.0]},"content":[{"type":"paragraph","content":[{"text":"Controls where resources can be loaded via XHR, WebSockets, or Fetch API calls.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[209.0]},"content":[{"type":"paragraph","marks":[{"type":"alignment","attrs":{"align":"center"}}],"content":[{"text":"font-src","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[547.0]},"content":[{"type":"paragraph","content":[{"text":"Controls where font files can be loaded from.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[209.0]},"content":[{"type":"paragraph","marks":[{"type":"alignment","attrs":{"align":"center"}}],"content":[{"text":"object-src","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[547.0]},"content":[{"type":"paragraph","content":[{"text":"Controls where plugins like

Browser not supported