Content Security Policy Settings for SharePoint Site Collections

Question

We are trying to add Content Security Policy(CSP) for SharePoint 2013 application. CSP will not allow inline scripts and styles. Hence the total site is getting collapsed. Adding "unsafe-inline" will fix the issue, but for security reasons, we are not adding "unsafe-inline". Have to fix the issue by adding "nonce" or encrypting with "Sha" values. How can we add "nonce" or "Sha" for all the scripts that are auto-generated in the SharePoint back-end or is there any alternate solution for it other than "unsafe-inline"

This link does not have an answer: https://social.technet.microsoft.com/Forums/en-US/8587394b-9421-43cb-a13e-1596d397a78e/adding-content-security-policy-for-sharepoint-2019?forum=SP2019

Answer 1

Hi @Joe Paul ,

From these 1,2,3 articles for research, it's necessary to use Nonces and Hashes to allow Inline Scripts.

You can set the HTTP Response Headers GUI in IIS Manager or add customHeaders to your web.config:

Since the content security policy is not within our scope of support, and I cannot find any official support, we provide less help on how to set up a detailed policy.

Note: Microsoft is providing this information as a convenience to you. The sites are not controlled by Microsoft. Microsoft cannot make any representations regarding the quality, safety, or suitability of any software or information found there. Please make sure that you completely understand the risk before retrieving any suggestions from the above link.

---

If an Answer is helpful, please click "Accept Answer" and upvote it.

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

Sounds like this is fixed in March 2024 update KB5002559

Improvements and fixes

This security update contains an improvement and a fix for the following nonsecurity issue in SharePoint Enterprise Server 2016:

• Allows users to disable SharePoint's Content Security Policy (CSP) HTTP header in SharePoint Pages. If you don't want to enable the SharePoint CSP HTTP header in SharePoint Pages, you can run the following cmdlets in PowerShell: Add-PSSnapin Microsoft.SharePoint.PowerShell $farm = Get-SPFarm $farm.EnableCSPHeaderForPage = $false $farm.Update()

https://support.microsoft.com/en-us/topic/description-of-the-security-update-for-sharepoint-enterprise-server-2016-march-12-2024-kb5002559-4ae5e078-9e6f-4df8-bec6-9215f0eff1df