Site checker keeps saying "Content security policy is not configured" even when set

(0) Share

Report

Posted on by Gary_Eden

381

When running the site checker I keep getting this message.

The Learn more link takes me here: https://learn.microsoft.com/en-us/power-pages/security/site-checker-security?WT.mc_id=powerportals_inproduct_portalstudio2#http-headers

Following the instructions I've created the setting and attached it to my site.

I had a similar message to set up the X-Content-Type-Options (as you can see from the above screenshot), I've set this up and the warning message has gone away.

I haven't done anything different setting up the content security policy but the warning won't go away. I've tried re-syncing several times and closed and reopened my browser, tried a different browser and even rebooted my PC all to no avail.

Am I missing something when adding the setting?

Categories:

Security

I have the same question (0)

All responses (4)

Answers (0)

Sort by

MH-02091453-0 125 on at

Like (0)

Report
Copy link

Link copied!

I have the same issue, I set mine to script-src 'nonce' as in microsoft documentation but the scanner is flagging it an a warning and not set. Any ideas?

Was this reply helpful? Yes No
Gary_Eden 381 on at

Like (0)

Report
Copy link

Link copied!

Hi @MichelleH
Still have the same problem across 3 sites in three separate environments (dev/test/live) using a combination of sandbox and production.
If I find the solution I'll post here, unless someone posts first (and we can use their method).

Was this reply helpful? Yes No
oliver.rodrigues 9,475 Most Valuable Professional on at

Like (0)

Report
Copy link

Link copied!

is this solved? probably best to open a support ticket with Microsoft

Was this reply helpful? Yes No
fm_skeller 277 Moderator on at

Like (0)

Report
Copy link

Link copied!
I think it needs a valid CSP string (and both examples are not as far as I can tell)
In addition, the portal needs a restart from the admin portal for the CSP to apply (the same goes for most site settings) - and after that it takes a while for the check to pass for some reason.
It should be something like this
script-src 'self' content.powerapps.com 'nonce';style-src 'self' content.powerapps.com 'unsafe-inline'; object-src 'none'
if you include additional js files or css files from external sources, you'd need to add those as well.

Was this reply helpful? Yes No