webMethods Developer Portal CSP (Content Security Policy) Troubleshooting
Tags: csp, webmethods, tutorial, troubleshooting
Published: 2022-11-07 13:59:44

---
title: webMethods Developer Portal CSP (Content Security Policy) Troubleshooting
published: true
date: 2022-09-16 10:01:13 UTC
tags: csp, webmethods, tutorial, troubleshooting
canonical_url: https://tech.forums.softwareag.com/t/webmethods-developer-portal-csp-content-security-policy-troubleshooting/263736
---

## Introduction

A Content Security Policy (CSP) is a security standard that provides an additional layer of protection from cross-site scripting (XSS), clickjacking, and other code injection attacks. It is a defensive measure against any attacks that rely on executing malicious content in a trusted web context, or other attempts to circumvent the same-origin policy.

webMethods Developer Portal is protected with CSP. So if you wanted too use the custom font (refer Customization section in documentation) or if you want to use SAML SSO with redirect binding then there would be set of CSP issues reported in browser console. The browser would not allow to load the scripts. In this tutorial you will learn how to configure the CSP so that external URL can be added as trusted source.

## Pre-requisite

- Basic knowledge of CSP
- Basic knowledge of webMethods Developer Portal

## Steps to follow

In this tutorial we will try adding custom font, so it will be get restricted by browser and we would see the steps to enable it.

## Step 1: Adding font in theme

Go to Administration → Themes, click customization button of your current theme

[![image](https://aws1.discourse-cdn.com/techcommunity/optimized/3X/a/4/a4d771e9fbbab87051932f1adb9bcfede84efc25_2_690x232.png)](https://aws1.discourse-cdn.com/techcommunity/original/3X/a/4/a4d771e9fbbab87051932f1adb9bcfede84efc25.png "image")

Navigate to Theme → Font subsection

[![image](https://aws1.discourse-cdn.com/techcommunity/optimized/3X/8/5/85b89cf5347e96182c8d207e25771e2b1418b0e7_2_690x221.png)](https://aws1.discourse-cdn.com/techcommunity/original/3X/8/5/85b89cf5347e96182c8d207e25771e2b1418b0e7.png "image")

Provide the external font URL and font name

[![image](https://aws1.discourse-cdn.com/techcommunity/optimized/3X/2/4/24ce731a64eca4b017a560d1caabe31301501fca_2_690x250.png)](https://aws1.discourse-cdn.com/techcommunity/original/3X/2/4/24ce731a64eca4b017a560d1caabe31301501fca.png "image")

## Step 2: Activate theme

Now activate the theme

[![image](https://aws1.discourse-cdn.com/techcommunity/optimized/3X/1/1/115beaea6eb64bc644217608b41f3c57a8274b84_2_690x145.png)](https://aws1.discourse-cdn.com/techcommunity/original/3X/1/1/115beaea6eb64bc644217608b41f3c57a8274b84.png "image")

After activating you’ll notice font’s are not loaded in appropriate style. If you check the browser developer console it would have reported unable to load the font script due to CSP policy

[![image](https://aws1.discourse-cdn.com/techcommunity/optimized/3X/0/a/0a14763894919a41b4ef53aa006f2648f6831a34_2_690x124.png)](https://aws1.discourse-cdn.com/techcommunity/original/3X/0/a/0a14763894919a41b4ef53aa006f2648f6831a34.png "image")

## Step 3: Adding the external font URL as trusted source

### 1. Shutdown the webMethods Developer Portal

### 2. Based on the deployment there are different ways to edit the CSP Policy

#### 2.A. On-premise i.e Local installation

Navigate to <Installation\_Location>/profiles/CTP/configuration you would find dpo\_wrapper.conf open to edit  
 ![image](https://aws1.discourse-cdn.com/techcommunity/original/3X/8/2/829e8fb04b0cbab892e86f98719410337b8a524d.png)

Add following java property [wrapper.java.additional.2006=-Dportal.server.config.headers.content-security-policy=“default-src ‘self’; img-src \* ‘self’ data:; object-src ‘none’; child-src \* mailto: tel: ms-word:; font-src ‘self’ [https://fonts.gstatic.com](https://fonts.gstatic.com); script-src ‘self’; style-src ‘self’ ‘unsafe-inline’ [https://fonts.goggleapis.com](https://fonts.goggleapis.com); form-action ‘self’ \*.okta.com; frame-ancestors ‘self’;”]. In this example for font i’ve added google font URL similarly for SAML SSO case i’ve added Okta URL

[![image](https://aws1.discourse-cdn.com/techcommunity/optimized/3X/8/9/89703dd6b50905cffe24e62f379c4c9d2f010215_2_690x97.png)](https://aws1.discourse-cdn.com/techcommunity/original/3X/8/9/89703dd6b50905cffe24e62f379c4c9d2f010215.png "image")

#### 2.B. Docker Deployment

In docker deployment, as part of docker run cmd you can pass the CSP value as environment variable ex:  
`docker run -d -e SPRING_ELASTICSEARCH_REST_URIS="http://lean-elastic:9200" -e PORTAL_SERVER_CONFIG_HEADERS_CONTENT_SECURITY_POLICY="default-src 'self'; img-src * 'self' data:; object-src 'none'; child-src * mailto: tel: ms-word:; font-src 'self' https://fonts.gstatic.com; script-src 'self'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; form-action 'self' *.okta.com; frame-ancestors 'self';" --name portalbundle --net lean-network -p 80:8083 -p 443:8084 kub-sic/devportal:10.15.0.0.126`

### 3. Start the webMethods Developer Portal

## Step 4: Validate the change

Open the developer tool in browser you should be able to see the CSP you provided as part of response headers

[![image](https://aws1.discourse-cdn.com/techcommunity/optimized/3X/2/4/248ca3c535274548d117e7f1953581db60e90417_2_690x313.png)](https://aws1.discourse-cdn.com/techcommunity/original/3X/2/4/248ca3c535274548d117e7f1953581db60e90417.png "image")

Now activate the theme

[![image](https://aws1.discourse-cdn.com/techcommunity/optimized/3X/1/1/115beaea6eb64bc644217608b41f3c57a8274b84_2_690x145.png)](https://aws1.discourse-cdn.com/techcommunity/original/3X/1/1/115beaea6eb64bc644217608b41f3c57a8274b84.png "image")

The font should be loaded properly. You won’t be seeing CSP error in browser console

[![image](https://aws1.discourse-cdn.com/techcommunity/optimized/3X/c/9/c998c92df98b5b2a887e5a193afbb954acebf9f5_2_690x147.png)](https://aws1.discourse-cdn.com/techcommunity/original/3X/c/9/c998c92df98b5b2a887e5a193afbb954acebf9f5.png "image")

[Read full topic](https://tech.forums.softwareag.com/t/webmethods-developer-portal-csp-content-security-policy-troubleshooting/263736)