Table of Contents

Content-Security-Policy

Niamh Ferns Updated by Niamh Ferns

CSP is an additional security layer that helps reduce the risk of common web attacks such as:

  • Cross-Site Scripting (XSS)
  • Data injection attacks

These attack types are often used for outcomes like data theft, site defacement, or distributing malware.

Clickjacking

CSP can help prevent clickjacking by using the frame-ancestors directive. This controls which websites (if any) are allowed to embed DeskDirector inside an iframe.

Cross-Site Scripting (XSS)

CSP can also limit which scripts are allowed to run. In DeskDirector, this helps prevent unknown or untrusted JavaScript from loading.

DeskDirector’s server only allows scripts from our approved CDN location.

Default setup

  • In server versions 19.66.x and above, the CSP header is enabled by default and is always returned by the server.
  • DeskDirector provides a secure default CSP configuration aligned with best practices.
  • With the default CSP, the only directive you can change is frame-ancestors.

The frame-ancestors directive defines which websites are allowed to embed DeskDirector (for example, embedding the Client Portal inside your own website).

You do not need to change this unless you plan to embed the Client Portal.

Valid values include:

  • A specific domain, e.g. https://www.example.org
  • A wildcard domain, e.g. https://*.example.org

Custom CSP setup (restricted)

DeskDirector does support custom CSP directives, but this is restricted to specific scenarios because incorrect CSP values can prevent the application from functioning correctly.

  • Additional CSP configuration is available through consulting for customers who have purchased the Platinum package.
  • Any custom directives are designed and approved by DeskDirector senior development team to reduce the risk of misconfiguration.

How did we do?

Cross-Origin Resource Sharing (CORS)

Contact