Content-Security-Policy on Cloud

Question

Recently a client was asking us to implement Content-Security-Policy and/or X-Frame-Options in our addon.

After some discussion we still don't have a clear idea on the matter. Does it make sense to implement CSP in Confluence Cloud apps?

Our guess is that our frames won't work out of context unless you have a valid signed jwt. So we should be safe there.

Does Atlassian have any suggestion or answer on this matter?

Regards,

Hugo

JimmyVanAU · Answer

May also be worth posting the question here https://community.developer.atlassian.com/ :)

Jack [AppFox] · Answer

You should definitely configure the Content Security Policy (CSP) for your Apps in the Cloud.

CSP reduces the attack vector of all kinds of vulnerabilities, e.g.

* Prevent inline scripts from running
* Restricting the domains that images, scripts, styles can come from

Sometimes, just by answering these questions, you can find things that are out of place.