Jump to content


Photo

Content Security Policy Header


  • Please log in to reply
5 replies to this topic

#1 MarkLince

MarkLince

    Active Member

  • uniGUI Subscriber
  • PipPipPip
  • 68 posts

Posted 01 July 2017 - 01:26 PM

Hi,

 

With ISAPI ap, can anyone tell me how to set Content Security Policy Header for UNIgui?

 

I have tried to set this in IIS 8 using the Header Response but no matter what options I set, my ap stops loading (loading....)

 

Thanks in advance.

Mark


  • 0

Delphi xe7

uniGUI Complete - Professional Edition 1.00RC 1391


#2 Farshad Mohajeri

Farshad Mohajeri

    Administrator

  • Administrators
  • 9465 posts

Posted 01 July 2017 - 02:53 PM

Hi,

 

You can add a custom meta tag to SeverModule->CustomMeta. However, it is very likely that your uniGUI web app will not load because CSP highly restricts execution of dynamic java script code. uniGUI apps need to dynamically execure JS code. You may find a correct receipt that will work with uniGUI, but it may take several trial and error attempts.


  • 0

#3 MarkLince

MarkLince

    Active Member

  • uniGUI Subscriber
  • PipPipPip
  • 68 posts

Posted 01 July 2017 - 03:11 PM

Hi Farshad,

Thanks for the speedy reply. OK, sounds like its unlikely to work, but I will try anyway and let you know.

Regards

Mark


  • 0

Delphi xe7

uniGUI Complete - Professional Edition 1.00RC 1391


#4 MarkLince

MarkLince

    Active Member

  • uniGUI Subscriber
  • PipPipPip
  • 68 posts

Posted 01 July 2017 - 04:03 PM

Hi farshad,

Just one thing, if CSP is not possible, what is the best way to mitigate xxs attacks in unigui aps

Thanks again

Mark


  • 0

Delphi xe7

uniGUI Complete - Professional Edition 1.00RC 1391


#5 Farshad Mohajeri

Farshad Mohajeri

    Administrator

  • Administrators
  • 9465 posts

Posted 01 July 2017 - 06:21 PM

First we need to find if XSS attacks are actually possible in a uniGUI app. Are there any examples od XSS that can be applicable to a unigui app?


  • 0

#6 MarkLince

MarkLince

    Active Member

  • uniGUI Subscriber
  • PipPipPip
  • 68 posts

Posted 14 July 2017 - 05:21 PM

I can't find any  :)  

Thanks Farshad


  • 0

Delphi xe7

uniGUI Complete - Professional Edition 1.00RC 1391





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users