WebMessaging - Content Security Policy -default src self or none

Web Messaging
1

hi All,

Just wondering if anyone can help us. We are looking at implementing security webmessaging on mobile browser with Genesys recommendation https://developer.genesys.cloud/commdigital/digital/webmessaging/contentSecurityPolicy#asia-pacific--sydney-.

And we are in Asia Pacific (Sydney region). And there are 2 option for content:

Option 1 CSPv3 : default-src 'self'

image
image959×446 13.7 KB

Option 2 : blank

image
image955×518 12.7 KB

So what is the recommendation, which CSP is used by mostly ? “default-src – self” or none?

Appreciate for any advise.

Fransiska

2

Hi Fransiska,

It really depends on your security requirements which CSP version to go with.

CSPv3 is latest vs CSPv2 was there from quite some time and most browsers support it.

About choosing the value default-src – 'self' or none, it should be the first. There should always be a default-src – 'self' because that is the fallback directive that browser will look for when you don't explicitly define each one like content-src, script-src and so on. You can find more info about usage here.

So, the general recommendation is to always put default-src – 'self' whether you go with CSPv2 or CSPv3.

3

Thanks @Ranjith_Manikante_Sa

Appreciate for the advise.

Fransiska

4

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.