CONTENTSECURITYPOLICYAKTIV - Detailed description

Overview

Parameter:CONTENTSECURITYPOLICYAKTIV
Category: Custom Default
value: 0 (disabled)
Product: eTASK.Other (Custom)

What does this parameter do?

This parameter enables or disables the Content Security Policy (CSP) for the eTASK portal. It controls whether the security policy defined in CONTENTSECURITYPOLICY is enforced by the browser. The parameter offers three modes: fully disabled, active blocking (violations are blocked), or Report-Only (violations are logged but not blocked).

What is this parameter used for?

• Enabling/Disabling the Content Security Policy

• Controlling the CSP mode (blocking vs. logging only)

• Safe testing phase for new CSP configurations (report-only mode)

• Gradual introduction of CSP security measures

• Troubleshooting CSP-related issues

Technical Details (for Administrators)

Format: Integer (whole number)
Default value: 0

Valid values:

• 0 = CSP is not used (disabled)

• 1 = CSP is enabled and enforced (blocking mode)

• 2 = CSP events are logged in the application log without blocking (report-only mode)

Important notes:

• This parameter controls only the activation, not the content of the CSP

• The actual CSP policy is defined in CONTENTSECURITYPOLICY

• For value 1: HTTP header content-security-policy , the following is sent

• If the value is 2: HTTP header content-security-policy-report-only is sent

• If value 0: No CSP header is sent

Interaction with other parameters:

• CONTENTSECURITYPOLICY: Defines the actual CSP policy (which resources are allowed)

• XFRAMEOPTIONS: Additional security measure against clickjacking

• CONTENTTYPEOPTIONSNOSNIFFACTIVE: Prevents MIME type sniffing

• XPERMITTEDCROSSDOMAINPOLICIES: Protection against cross-domain embedding

When should you change this value?

Leave the value set to 0 (disabled) if:

• You do not want to use CSP

• You are experiencing issues with the current CSP configuration and need to respond quickly

• External resources are included that cause CSP violations

Set the value to 1 (active blocking) if:

• You want maximum protection against XSS attacks

• The CSP configuration has been thoroughly tested

• You have successfully completed the report-only mode

• You want to go live with active CSP security measures

Set the value to 2 (Report-Only) if:

• You want to test a new CSP configuration

• You want to identify violations without blocking functions

• You want to roll out CSP incrementally

• You want to analyze the impact of CSP changes

Important Notes

1. Use Report-Only mode
   for testing Before you enable CSP (value 1), test extensively using value 2 (Report-Only). This allows you to identify CSP violations without blocking functions.

2. Monitor the application
   log In Report-Only mode (value 2), CSP violations are logged in the application log. Check the logs regularly for entries regarding blocked resources.

3. Check the browser
   console CSP violations are also displayed in the browser developer console (F12), regardless of the mode. Use this for quick debugging.

4. Quick deactivation in case of problems If CSP causes unexpected issues, you can immediately disable CSP by setting the value to 0 without having to modify CONTENTSECURITYPOLICY.

5. Gradual activation recommended
   Recommended sequence: 0 (disabled) → 2 (report-only, test over several days) → 1 (actively blocking)

6. No intermediate values
   Use only the values 0, 1, or 2. Other values are treated as 0 (disabled).

Security

Does changing this parameter affect security?

Yes, this parameter has direct security implications.

Positive security aspects:

Value 1 (enabled):

• Maximum XSS protection: Actively blocks unauthorized scripts

• Code injection protection: Prevents execution of unwanted scripts

• Real-time protection: Browser enforces CSP rules immediately

• Defense-in-Depth: Additional security layer for web applications

Value 2 (Report-Only):

• Safe testing: Enables CSP testing without affecting functionality

• Monitoring: Identifies potential security vulnerabilities

• Preparation: Detects issues before production deployment

Security Risks:

Value 0 (disabled):

• No CSP protection: XSS attacks are not prevented by CSP

• Increased risk: Code injection attacks are possible

• Missing security layer: No CSP-based protection

Value 2 (Report-Only):

• Monitoring only: Attacks are detected but not blocked

• No active defense: Protection is passive, not preventive

Best Practices:

1. Production systems: Use Level 1 (active) for maximum security

2. Test/development environments: Use value 2 for secure testing

3. Emergencies: Use value 0 only temporarily for acute problems

4. Monitoring: Continue monitoring logs at value 1

5. Regular checks: Verify CSP configuration with every update

Recommendation: For production systems, CONTENTSECURITYPOLICYAKTIV should be set to 1, provided the CSP configuration is correct and has been tested. Report-Only mode (2) is ideal for the testing phase but should not be used permanently in production.

Practical example

Initial situation: You have successfully installed the eTASK portal and now want to activate the Content Security Policy to secure the portal against XSS attacks. However, you are unsure whether the default CSP allows all functions.

Recommended procedure:

Phase 1: Initial state (value 0)

Current configuration: - CONTENTSECURITYPOLICYAKTIV = 0 - CONTENTSECURITYPOLICY = (default value)

The portal is running without CSP protection.

Phase 2: Report-Only Test (Value 2)

1. Set CONTENTSECURITYPOLICYAKTIV = 2

2. Test the portal for 3–7 days during normal operation

3. All functions work normally (nothing is blocked)

4. CSP violations are only logged

Monitoring during the test phase:

Check the application log and the browser console (F12) daily:

Example log entries for violations:

[CSP] Refused to load script from 'https://external-cdn.com/script.js' 
because it violates the Content Security Policy directive: "default-src 'self'..."

Result after the test phase:

• No CSP violations found → Phase 3

• CSP violations found → Adjust CONTENTSECURITYPOLICY, retest with value 2

Phase 3: Activation (value 1)

After successful test phase:

1. Set CONTENTSECURITYPOLICYAKTIV = 1

2. CSP is now active and blocks violations

3. Portal is protected against XSS attacks

4. All legitimate functions continue to work

After activation:

• HTTP header content-security-policy are sent with every request

• The browser actively enforces CSP rules

• Unauthorized scripts are blocked

• The portal is more secure against XSS and code injection attacks

• Monitoring remains active (browser console continues to display violations)

Emergency deactivation:

If a critical issue occurs after activation:

1. Immediately reset CONTENTSECURITYPOLICYAKTIV to 0

2. The portal works again without CSP restrictions

3. Analyze the problem

4. Adjust CONTENTSECURITYPOLICY

5. Test again with the value 2 (Report-Only)

6. Reactivate with value 1

Result: By enabling the policy in stages using Report-Only mode, all CSP issues were identified and resolved before active blocking was enabled. The portal is now secure against XSS attacks without compromising functionality.

Recommended setting

For production systems:1(active blocking)

Reason:

• Maximum security against XSS attacks

• Active defense against code injection

• Proven security measure

• Browsers consistently enforce CSP rules

• Standard in modern web security concepts

For test/development environments:2(Report-Only)

Reason:

• Secure testing phase for new CSP configurations

• Identification of issues without compromising functionality

• Monitoring of potential security vulnerabilities

• Preparation for production deployment

Recommended workflow for new installations:

1. Start: Value 0 (disabled) for initial setup

2. Test: Value 2 (Report-Only) for 3–7 days during normal operation

3. Monitoring: Check logs and browser console for violations

4. Adjustment: If violations: Adjust CONTENTSECURITYPOLICY, return to step 2

5. Activation: Value 1 (active) after successful test phase

6. Maintenance: Regularly review the CSP logs

Important: Do not leave production systems permanently set to value 2 (Report-Only). This mode is intended for testing only. Value 1 is required for actual protection.