Portail ZAPP protects every page with a Content Security Policy (CSP): the browser only runs scripts issued by the application, and only loads images, fonts, videos or frames from allowed origins. A script injected by a third party (booby-trapped content, malicious extension) is refused.
When the browser refuses something, it reports it to the application. The summary of these reports, reserved for Administrators, is at /administration/security/csp-reports.
What the summary shows
The summary is displayed as JSON, readable directly in the browser. It contains:
mode:Enforce(the policy is applied: anything reported was blocked),Report(the policy is only measured: nothing is blocked, everything is reported) orOff;generatedAt: the time of the summary (UTC);dropped: the number of reports discarded for lack of room (the summary keeps at most 1,000 groups; the least recent make room for new ones);entries: the grouped violations, most frequent first.
Each group gathers identical reports:
| Field | Meaning |
|---|---|
directive |
The type of content refused: script-src-elem (script), style-src (style), img-src (image), font-src (font), frame-src (embedded frame), connect-src (network call)… |
blocked |
What was refused: an origin (https://example.com), inline (code written in the page) or eval (code built on the fly) |
page |
The page where it happened; (externe) if the report comes from a page outside the application |
module |
The first segment of the page (tickets, kb…), to know which module is concerned |
count, firstSeen, lastSeen |
Number of occurrences, first and last time |
sourceFile, line |
The file and line involved, when the browser provides them |
The summary is kept in memory: it starts from scratch at each restart. Each new group is also written to the application log, which keeps a trace of it.
What to do with a violation
An empty summary is the normal state. For each listed group:
- A legitimate external origin (a theme's font, a video host, a human verification service): the instance's host allows it on the server side, in the
Security:Csp:Sources:<directive>:<n>configuration (for exampleSecurity:Csp:Sources:font-src:0=https://fonts.gstatic.com). Only a precisehttps://address is accepted; allowing "everything" is impossible. This setting is not made from the interface. inlineorevalon a Portail ZAPP screen: the screen is probably broken (a button or menu no longer responds). Report it to support with the page, directive, file and line.- An unknown origin: it may be a user's browser extension, or booby-trapped content that the policy blocked. If the page shows content entered by a user (article, ticket), check that content.
(externe): a report from a page outside the application, with no consequence for it.
Reports are limited in number and size: a flood cannot saturate the application.
See also
- "Monitoring the instance": instance status and support diagnostics.