Content-Security-Policy on Cloud

[Hugo Ingelmo]

Recently a client was asking us to implement Content-Security-Policy and/or X-Frame-Options in our addon.

After some discussion we still don't have a clear idea on the matter. Does it make sense to implement CSP in Confluence Cloud apps? 

Our guess is that our frames won't work out of context unless you have a valid signed jwt. So we should be safe there.

Does Atlassian have any suggestion or answer on this matter?

Regards,

Hugo

[JimmyVanAU]

May also be worth posting the question here https://community.developer.atlassian.com/ :)

[Jack [AppFox]]

You should definitely configure the Content Security Policy (CSP) for your Apps in the Cloud.

CSP reduces the attack vector of all kinds of vulnerabilities, e.g.

• Prevent inline scripts from running
• Restricting the domains that images, scripts, styles can come from

Sometimes, just by answering these questions, you can find things that are out of place.