You're viewing **Apigee Edge** documentation.  
[Go to the
**Apigee X** documentation](http://cloud.google.com/apigee/docs/api-platform/publish/portal/csp). info


> [!NOTE]
> **Note:** The integrated portal is available as an Apigee-managed solution for Apigee Edge for Public Cloud customers only. If you are an Apigee Edge for Private Cloud customer, refer to the customer-managed [Drupal portal solution](https://docs.apigee.com/api-platform/publish/drupal/open-source-drupal).

<br />

Configure a content security policy (CSP) for all pages in your portal to protect against cross-site scripting (XSS) and other code-injection attacks. The CSP defines trusted sources for content such as scripts, styles, and images. After configuring a policy, content loaded from untrusted sources will be blocked by your browser.

The CSP is added as a `Content-Security-Policy` HTTP response header to all pages in your portal, as follows:

`Content-Security-Policy: policy`

You define the policy using directives, as defined in [Content Security Policy Directives](https://www.w3.org/TR/CSP3/#csp-directives) in the W3C site.

If you enable the CSP header, by default the following CSP directive is defined:

`default-src 'unsafe-eval' 'unsafe-inline' * data:`

The `default-src` directive configures the default policy for resource types that do not have a configured directive.

> [!NOTE]
> Apigee recommends that you define a default directive as part of the CSP to configure the minimum restrictions.

The following table describes the policies defined as part of the default directive.

| Policy | Access |
|---|---|
| `'unsafe-inline'` | Inline resources, such as inline `<script>` elements, `javascript:` URLs, inline event handlers, and inline `<style>` elements. **Note**: You must enclose the policy in single quotes. |
| `'unsafe-eval'` | Unsafe dynamic code evaluation such as JavaScript `eval()` and similar methods used to create code from strings. **Note**: You must enclose the policy in single quotes. |
| `* (wildcard)` | Any URL except `data:`, `blob:`, and `filesystem:` schemes. |
| `data:` | Resources loaded via the data scheme (for example, Base64-encoded images). |

The following provides examples of configuring the CSP to restrict specific resource types.

| Policy | Access |
|---|---|
| `default-src 'none'` | No access for resource types that do not have a configured directive. |
| `img-src *` | Image URL from any source. |
| `media-src https://example.com/` | Video or audio URL over HTTPS from the `example.com` domain. |
| `script-src *.example.com` | Execution of any script from a subdomain of `example.com`. |
| `style-src 'self' css.example.com` | Application of any style from the site's origin or the `css.example.com` domain. |

To configure a content security policy:

1. Select **Publish \> Portals** and select your portal.
2. Select **Settings** in the drop-down menu in the top navigation bar.
3. Alternatively, click **Settings** on the portal landing page.
4. Click the **Security** tab.
5. Click **Enable content security policy**.
6. Configure the CSP or leave the default.
7. Click **Save**.

You can restore the default CSP policy at any time by clicking **Restore default**.