/
Web-Gateway Content Security Policy (CSP) Allowlisting

Web-Gateway Content Security Policy (CSP) Allowlisting

Overview

Syndeia Cloud (SC) 3.7 introduces the following new integrations and an update to an existing one, that dynamically load icons for displaying in the Web Dashboard.

  • MS Azure DevOps (ADO)

  • PTC Codebeamer

  • Siemens Polarion

  • PTC Windchill ADDED IN 3.7.1

If you use any of these integrations you will need to add allowlist entries for these in SC web-gateway’s application.conf file.

These allowlist entries allow your SC web application to dynamically retrieve and show content from these 3rd-party integration servers (on-prem or cloud), ex: custom status icons.

Pre-reqs

FQDNs for each of the following, if they are used:

  • MS Azure DevOps (ADO) - note, ADO seems to use https://tfsprodeus26.visualstudio.com for all custom status icons.

  • PTC Codebeamer

  • Siemens Polarion

  • PTC Windchill

Steps

  1. On your Syndeia Cloud (SC) server, edit /opt/syndeia-cloud-current/web-gateway-3.7/conf/application.conf

  2. Locate the section shown below:

    # Security Filter Configuration - Content Security Policy # Note the URL for the SAML IdP. This _may_ need to be modified to match the actual host if SAML is used play.filters.headers { contentSecurityPolicy = "default-src 'self';" # -> look at connect-src ... contentSecurityPolicy = ${play.filters.headers.contentSecurityPolicy}" connect-src 'self' http://samlidp.example.com:9090;" contentSecurityPolicy = ${play.filters.headers.contentSecurityPolicy}" img-src 'self';" contentSecurityPolicy = ${play.filters.headers.contentSecurityPolicy}" style-src 'self' 'unsafe-inline';" contentSecurityPolicy = ${play.filters.headers.contentSecurityPolicy}" font-src 'self' 'unsafe-inline';" contentSecurityPolicy = ${play.filters.headers.contentSecurityPolicy}" script-src 'self' 'unsafe-inline' 'unsafe-eval';" }

  3. On L7 of the code block above, edit img-src ‘self’; and insert the FQDN(s) for each of the 3rd-party integration(s) that you use before the ;,
    ex: if you use all 3 integrations and have the following FQDNs
    - MS Azure DevOps (ADO) : https://tfsprodeus26.visualstudio.com
    - PTC Codebeamer : https://myCodebeamer.domain.tld:8443
    - Siemens Polarion : https://myPolarion.domain.tld
    - PTC Windchill: https://myWC.domain.tld
    … update the CSP to the following:

    " img-src 'self' https://tfsprodeus26.visualstudio.com https://myCodebeamer.domain.tld:8443 https://myPolarion.domain.tld https://myWC.domain.tld ;"

  4. Restart the web-gateway service:

    sudo systemctl restart sc-web-gateway