Web Security Policies

Web security policies define how web applications interact with the browser, helping to prevent unauthorized content execution and feature access. These policies enhance security by controlling what resources can be loaded and which browser capabilities can be used.

In this topic:

Permissions Policy

PPM implements the Permissions-Policy HTTP response header to control access to browser features and APIs. This policy enhances security and privacy by restricting features such geolocation, camera, and more, for specified origins.

You can configure the PERMISSIONS_POLICY parameter to specify which features are allowed or restricted. The value for this parameter should be a valid Permissions-Policy directive, specifying the allowed origins for each feature. For details on this header and its valid directives, see the W3C specifications.

Content Security Policy

PPM implements the Content-Security-Policy HTTP response header to restrict the resources, such as images and JavaScript that are allowed to load.

The default Content-Security-Policy header value is:

'default-src blob: 'self' 'unsafe-inline' 'unsafe-eval' %TRUSTED_EXTERNAL_URLS%;img-src 'self' data: %TRUSTED_EXTERNAL_URLS%;font-src 'self' data:

Where %TRUSTED_EXTERNAL_URLS% is a placeholder that is replaced by the value of the TRUSTED_EXTERNAL_URLS server parameter.

You can modify the content security policy by editing either of the following parameters:

Parameter	Description
TRUSTED_EXTERNAL_URLS (Recommended)	Use this parameter to add the URLs of the sites from which you want to embed content, either using iframes or reading scripts, images, or other resources from the sites. The default value of this parameter is: https://app.powerbi.com admhelp.microfocus.com, enabling the embedding of the PPM online help and PowerBI on dashboards. If you want to embed other web sites as iframes on PPM with a URL portlet, Web Frame portlet, or HTML+ portlet, add the external web site domains to the TRUSTED_EXTERNAL_URLS parameter.
CONTENT_SECURITY_POLICY	Use this parameter to edit the value of the Content-Security-Policy HTTP response header. Refer to standard Content Security Policy documentation for this header and its possible values.

For details on how to modify the server parameters, see Configure server configuration parameters .