How to create and add Content-Security-Policy in SAP Commerce Cloud?

[SAPSupport]

Dear SAP,

We are planning to integrate our Storefront with a third party service, which requires to be whitelisted in a Content-Security-Policy (CSP) in order to successfully work, but I am not sure how and where to create it. 

Any ideas?

Thanks in advance! 

------------------------------------------------------------------------------------------------------------------------------------------------
Learn more about the SAP Support user and program here.

[SAPSupport · Accepted solution]

Hello there!

The Content-Security-Policy has different approaches based on the Storefront you are running: For the Accelerator Storefront, it is configured through the property "xss.filter.header.Content-Security-Policy" in the affected endpoint aspect. More information in our documentations:

• Creating Custom Content Security Policy Response Headers
• Adding HTTP CSP Frame-Ancestors

For the Composable Storefront you need to do it through an HTTP Response Header Set. The KBA 3334671 - Response Header set X-Frame-Options to deny - SAP Commerce Cloud is for a specific scenario, but in its resolution it explains how the Response Header with CSP should be configured:

• Header Name: Content-Security-Policy
  Header Value: frame-ancestors 'self'{your domains}
  Apply Action: SET
  Apply Condition: ALWAYS

Therefore, kindly create a response header with the desired configuration similar to the above one and assign it to your Composable Storefront.

Kind Regards,
Wesley
SAP Support