How do I set up the Content Security Policy (CSP)?

In the i-Reserve environment, it is possible to configure a Content Security Policy (CSP). A CSP is an additional security layer that helps prevent malicious scripts and unwanted content from being executed in the i-Reserve environment. The CSP tells the browser which sources of content (such as scripts, stylesheets, images, and videos) may or may not be loaded and executed.

To configure these allowed sources, go to configuration mode in the i-Reserve environment. Then navigate to System > Security Settings. At the bottom of this page, you will find the settings related to the CSP.

The setting Content Security Policy (CSP) – Allowed Domains allows you to enter the sources from which all scripts and content may be executed and/or loaded in the environment. If there are sources that should only be allowed to execute and/or load specific scripts and content, these can be added to the option Content Security Policy (CSP) – Override.

The setting Content Security Policy (CSP) – Allowed Widget Domains is specifically for the i-Reserve widget. In this setting, you can specify the domains from which the widget may be loaded.