Differences

This shows you the differences between two versions of the page.

--- administration:security:content_security_policy [2020/06/29 12:14] – created demiankatz
+++ administration:security:content_security_policy [2020/06/29 18:20] – [Configuring VuFind's CSP] demiankatz
@@ Line 7: / Line 7: @@
 You can learn more at the [[https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP|Mozilla Developer Resources Content Security Policies page]].
+===== Configuring VuFind's CSP =====
+==== Configuration File ====
+All settings related to Content Security Policies can be found in contentsecuritypolicy.ini.
+==== Enforcing vs. Reporting ====
+The CSP can be configured to either block violating content, or simply to report problems. VuFind is set to reporting mode by default to avoid backward compatibility breaks.
+=== Receiving Reports ===
+When in reporting mode, you can set the report-to setting in contentsecuritypolicy.ini to send reports of violations to a URI that implements a simple API. VuFind does not currently include a built-in reporting endpoint, but several options exist, including:
+  * [[https://github.com/seek-oss/csp-server|seek-oss/csp-server]] - an open source, Node.js-based solution
+  * [[https://report-uri.com/|ReportURI]] - a commercial, cloud-based service
 ===== Best Practices / Recommendations =====