Content Security Policy

Harden EO.workspace Web Client and Distributed Session Manager with Content-Security-Policy HTTP headers.

EO.workspace uses Content-Security-Policy HTTP headers to help reduce cross-site scripting (XSS) risks and other attacks on modern browsers by declaring how dynamic resources are allowed to load. These headers are present in the components that can be accessed by a browser (Web Client and Distributed Session Manager).

Content Security Policy (CSP) is an added layer of security that helps to detect and mitigate certain types of attacks, including cross-site scripting (XSS) and data injection attacks. These attacks are used for everything from data theft, to site defacement, to malware distribution.