Content Security Policy

Your SAP Cloud ALM tenant is protected from attacks including cross-site scripting and data injection through the Content Security Policy.

The Content Security Policy (CSP) is a browser security mechanism that restricts the sources from which the browser is allowed to load resources, such as scripts, fonts, and images. This mechanism adds an additional layer of security that enables the detection and mitigation of certain types of attacks including cross site scripting and data injection.

To protect your SAP Cloud ALM tenant, the following directives are enabled by default:

Directive	Function	Trusted Domains
childSrc	Specifies the sources for nested browsing contexts	SAP Cloud ALM domains and limited external domains (HTTPS connection only)
connectSrc	Restricting the domains to which connection requests are made from a webpage	SAP Cloud ALM domains and limited external domains (HTTPS connection only)
frameSrc	Controls the sources for embedding <frame> or <iframe> content	SAP Cloud ALM domains and limited external domains (HTTPS connection only)
fontSrc	Defines allowed sources for fonts	SAP Cloud ALM domains and limited external domains (HTTPS connection only)
imgSrc	Restricting the domains from which image resources are loaded	SAP Cloud ALM domains and limited external domains (HTTPS connection only)
scriptSrc	Restricting the locations from which scripts can be executed	SAP Cloud ALM domains and limited external domains (HTTPS connection only)
styleSrc	Controls the sources from which stylesheets can be loaded	SAP Cloud ALM domains and limited external domains (HTTPS connection only)