Open topic with navigation

# ContentSecurityPolicy

The Content-Security-Policy HTTP header to add to the response for View actions where NoACI is set to `True` and where StripScript is set to `True`.

By default, when StripScript is enabled, HPE IDOL Server adds the following HTTP headers to prevent Web browsers from running any scripts embedded in the HTML:

    Content-Security-Policy: script-src 'none';
    X-Content-Security-Policy: sandbox

This configuration parameter allows you to modify the value of the Content-Security-Policy header.

To remove the header, set `ContentSecurityPolicy` to a whitespace value. Removing the Content-Security-Policy header also removes the X-Content-Security-Policy header. You cannot modify the X-Content-Security-Policy header, except to remove it.

Type: | String
Default: | script-src 'none';
Required: | No
Configuration Section: | Viewing
Example: | `ContentSecurityPolicy=default-src 'none';`
See Also: | StripScript View action StripScript parameter

© 2016 Hewlett Packard Enterprise Development LP | Send documentation feedback to HPE Close Send Documentation Feedback To open the configured email client on this computer, open an email window. Otherwise, copy the information below to a web mail client, and send this email to AutonomyTPFeedback@hpe.com. We appreciate your feedback! Product: Topic Title: Help Topic: Feedback:

_HP_HTML5_bannerTitle.htm