About

This article explains how to generate, test, and apply a Content Security Policy (CSP) for Content Hubs or legacy Video Portal.

What is a Content Security Policy (CSP)?

A Content Security Policy (CSP) is a security standard that helps protect sites from web attacks by controlling which sources the browser can use to load scripts, images, styles, fonts, media, and embedded content.

For more information about CSP, see Content Security Policy (CSP) on the MDN Web Docs website.

Kaltura CSP security alert

If you see a CSP security alert in the Configuration Management console, it means a CSP hasn't been configured. It doesn't mean there's been a security breach.

You can dismiss the alert for the current session. It appears again the next time you log in until you configure a CSP.

How to configure a CSP

Overview of the process

Configuration involves three main steps:

1. Generate an initial policy based on your site's configuration.
2. Test and review the policy without blocking content or features.
3. Apply the policy after resolving any unexpected warnings.

Step 1: Generate the initial policy

You'll configure your CSP in the Security module in the Configuration Management console. The module includes separate fields for testing and applying your policy.

Start by generating a policy based on your site's configuration. The generated policy is a starting point that you'll test before applying it.

1. Log in to the Configuration Management console.
2. Open the Security module.
The Security module settings display.
3. Scroll down to the cspHeader field, and click the Generate CSP button.



The Recommended CSP window opens and displays a policy.

Example only – your policy will differ


4. Review the policy.

   The generated policy includes recommended starting directives, such as default-src and object-src 'none'. It can still omit sources required by your integrations or customizations. The generated policy also depends on whether Theming is enabled on your site:

   • If Theming is enabled on your site, the relevant directives use nonce tokens instead of broad 'unsafe-*' allowances.
   • If Theming isn't enabled on your site, the relevant directives include 'unsafe-inline' and 'unsafe-eval' where required. To avoid these values, enable Theming on your site.
5. Click Copy & Close.

   The policy is copied, and the window closes. The policy is not applied automatically.

Understand your initial policy

Your policy is made up of directives, such as script-src, img-src, and connect-src. Each directive lists the sources that the browser can use for that type of content.

The table below explains the directives you might see in your generated policy.

Directive	What it controls
default-src	Provides a fallback rule for many resource types that do not have their own directive.
script-src	Controls which scripts the browser can run.
style-src	Controls stylesheets and inline styles.
img-src	Controls images.
font-src	Controls fonts.
connect-src	Controls browser connections to APIs, analytics services, and other endpoints.
frame-src	Controls content that the site can load in frames.
frame-ancestors	Controls which websites can display your site in a frame.
media-src	Controls audio and video sources.
object-src	Controls plugins and other embedded objects. The generated policy sets this to 'none'.

Understand the allowed sources

Each directive lists the sources that the browser can use. A source can be the current site, a specific domain, a group of subdomains, or a special value such as 'none'.

The table below explains the source values you might see in your generated policy.

Value	Meaning
'self'	Allows resources from the same site.
'none'	Prevents the resource type from loading from any source.
https://example.com	Allows resources from one specific HTTPS domain.
https://*.example.com	Allows resources from subdomains of the specified domain.
https:	Allows resources from any domain over HTTPS.
'unsafe-inline'	Allows inline code. This reduces CSP protection and should be used only with security-team approval. The generated policy can include this value if Theming isn't enabled on your site.
'unsafe-eval'	Allows dynamic code evaluation. This reduces CSP protection and should be used only when required and approved. The generated policy can include this value if Theming isn't enabled on your site.
'nonce-...'	Allows inline code containing a matching one-time value.

Step 2: Test and review the policy

Test the policy

Test your policy before applying it by adding it to the cspHeaderReportOnlyHeader field in the Security module. This puts the policy in report-only mode, where the browser reports what it would block without actually blocking it.

1. In the Security module, find the cspHeaderReportOnlyHeader field.
2. Paste the policy you copied in Step 1 into the field.
3. Click Save.
The policy is now active in report-only mode.
4. Open your Content Hub or legacy Video Portal in a new browser tab.
5. From that tab, open your browser's developer tools.
6. Select the Console tab.
7. On the Console page, click the Clear icon to remove existing messages.

   

8. Refresh the site.
9. With Developer Tools open, test a workflow in the same browser tab, such as playing media, searching, or uploading media.
10. Check the browser Console for CSP messages as you use the site.

If the policy detects a violation, a message appears in the browser Console. Look for The policy is report-only, which confirms that the violation was logged without blocking the resource.



A CSP violation means that the resource isn't allowed by the policy you're testing. If you apply the policy without making changes, the resource could be blocked.

A reported resource isn't necessarily a security risk. Confirm that the resource is trusted and required before adding it to the policy. Don't automatically allow every domain reported in the Console.

Review the test results

Each CSP violation normally identifies:

• The resource that the policy would block
• The directive responsible for the violation
• The page or feature that attempted to load the resource

For each violation:

1. Confirm whether the resource is trusted and required for your site.
2. Ask your security or web development team to review any source you don't recognize.
3. Add an approved, required source to the appropriate directive.
4. Save the updated report-only policy.
5. Refresh and test the site again.

Repeat this process until there are no unexpected violations in the workflows you tested.

If you see warnings about scripts

A script is code that runs on a webpage. Some scripts are included directly in the page instead of being loaded from a separate file. The browser reports a warning when one of these scripts isn't allowed by the script-src directive in the policy.

The browser might suggest allowing inline scripts, adding a script hash, or using a nonce. Before changing the policy, ask your security or web development team which option is appropriate.

If Theming is enabled on your site, the generated policy already includes nonce tokens.

Step 3: Apply the tested policy

When you add the tested policy to cspHeader, the browser begins blocking content and connections that the policy does not allow.

Don't click Save until you've completed all the field changes below. This prevents the site from being left in a partially configured state.

1. Copy the tested policy from the cspHeaderReportOnlyHeader field.
2. Paste it into the cspHeader field.
3. Clear the cspHeaderReportOnlyHeader field.
4. Click Save.
The policy is applied. The browser now blocks resources that the policy doesn't allow.
5. Test the site's main workflows again.

After cspHeader contains a policy, the CSP security alert no longer displays when administrators log in to the Configuration Management console.

Do I need a separate policy for the Configuration Management console?

In most cases, you don't need a separate policy. When adminCspHeader is empty, the Configuration Management console uses the policy in the cspHeader field.

Configure a separate policy only when the console needs to load different content or connect to different sources from your site. Use the following fields:

• adminCspHeaderReportOnlyHeader - Tests a separate policy for the console without blocking content or features.
• adminCspHeader - Applies the tested policy to the console instead of the policy in cspHeader.

Advanced: Use nonce tokens

What is a nonce?

A nonce, or number used once, is a unique value generated each time a page loads. It allows the browser to run approved inline scripts or apply approved inline styles without allowing all inline code.

Available nonce tokens

The Security module supports the following tokens:

• 'nonce-{{scriptNonce}}' for scripts
• 'nonce-{{styleNonce}}' for styles

When the page loads, Kaltura replaces the token with a randomly generated nonce value.

If Theming is enabled on your site, Generate CSP includes the applicable nonce tokens in the suggested policy.

Troubleshooting

Issue	What to do
No policy is generated.	This usually means your site has a unique configuration. Don't enter or apply an empty policy. Contact Kaltura Support so they can review your site's settings.
You can't access the Configuration Management console after applying a policy.	Contact Kaltura Support.