---
schema_version: "1"
id: fd3d3c44eec78e296ef98e732d1693a0e805407c9215128e18e22556a8d10eab
title: Content Security Policy
collection: tableau
version: next
locale: en-us
portal_url: https://docs.salesforce.com/tableau/next/en-us/server-linux/security_csp.md
canonical_url: https://help.tableau.com/v0.0/server-linux/en-us/security_csp.htm
source_site: help.tableau.com
content_type: documentation
content_hash: c08b01d2b8237d10bde374087a5470544958bdd8da3468fffedffaebb1fb1920
description: Configure and enable Content Security Policy on Tableau Server.
---
[Skip to main content](#main-content)

# Content Security Policy

Tableau Server supports the Content Security Policy (CSP) standard. CSP is intended to be an additional layer of security against cross-site scripting and other malicious web-based attacks. CSP is implemented as a HTTP response header that allows you to specify where external resources, such as scripts and images, can be safely loaded from.

See the [Mozilla website](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP) for more information about CSP.

## Configure and enable CSP

CSP is configured and enabled using the [tsm configuration set Options](https://help.tableau.com/v0.0/server-linux/en-us/cli_configuration-set_tsm.htm) command. If you are running Tableau Server in a distributed deployment, run these commands on the initial node in the cluster. The configuration will be applied across the cluster after you run [tsm pending-changes apply](https://help.tableau.com/v0.0/server-linux/en-us/cli_pending-changes.htm#pending-changes-apply).

### Step 1: Set default directives

Tableau Server includes the set of default directives in the table below.

To set a directive, use the following tsm syntax:

`tsm configuration set -k content_security_policy.directive.<directive_name> -v "<value>"`

For example, to set the `connect_src` directive, run the following command:

`tsm configuration set -k content_security_policy.directive.connect_src -v "* unsafe-inline"`

<table style="width: 100%;" class="simple-table">
                    <colgroup><col style="width: 45%;">
                    <col style="width: 20%;">
                    <col style="width: 25%;">
                    </colgroup><tbody>
                        <tr>
                            <th>Option</th>
                            <th>Default value</th>
                            <th>
                                <p>Description</p>
                            </th>
                        </tr>
                        <tr>
                            <td>content_security_policy.directive.default_src</td>
                            <td>‘none’</td>
                            <td>
                                <p>Serves as a fallback for the other fetch directives.</p>
                                <p><a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/default-src" target="_blank">Valid values for <code>default_src</code></a>.</p>
                            </td>
                        </tr>
                        <tr>
                            <td>content_security_policy.directive.connect_src</td>
                            <td>*</td>
                            <td>
                                <p>Restricts the URLs which can be loaded using script interfaces.</p>
                                <p><a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/connect-src" target="_blank">Valid values for <code>connect_src</code></a>.</p>
                            </td>
                        </tr>
                        <tr>
                            <td>content_security_policy.directive.script_src</td>
                            <td>*</td>
                            <td>
                                <p>Specifies valid sources for JavaScript.</p>
                                <p><a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/script-src" target="_blank">Valid values for <code>script_src</code></a>.</p>
                            </td>
                        </tr>
                        <tr>
                            <td>content_security_policy.directive.style_src</td>
                            <td>* ‘unsafe-inline’</td>
                            <td>
                                <p>Specifies valid sources for stylesheets.</p>
                                <p><a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/style-src" target="_blank">Valid values for <code>style_src</code></a>.</p>
                            </td>
                        </tr>
                        <tr>
                            <td>content_security_policy.directive.img_src</td>
                            <td>* data:</td>
                            <td>
                                <p>Specifies valid sources of images and favicons.</p>
                                <p><a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/img-src" target="_blank">Valid values for <code>img_src</code></a>.</p>
                            </td>
                        </tr>
                        <tr>
                            <td>content_security_policy.directive.font_src</td>
                            <td>* data:</td>
                            <td>
                                <p>Specifies valid sources for fonts loaded using @font-face.</p>
                                <p><a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/font-src" target="_blank">Valid values for <code>font_src</code></a>.</p>
                            </td>
                        </tr>
                        <tr>
                            <td>content_security_policy.directive.frame_src</td>
                            <td>* data:</td>
                            <td>
                                <p>Specifies valid sources for nested browsing contexts loading using elements such as &lt;frame&gt; and &lt;iframe&gt;.</p>
                                <p><a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/frame-src" target="_blank">Valid values for <code>frame_src</code></a>.</p>
                            </td>
                        </tr>
                        <tr>
                            <td>content_security_policy.directive.object_src</td>
                            <td>data:</td>
                            <td>
                                <p>Specifies valid sources for the &lt;object&gt;, &lt;embed&gt;, and &lt;applet&gt; elements.</p>
                                <p><a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/object-src" target="_blank">Valid values for <code>object_src</code></a>.</p>
                            </td>
                        </tr>
                        <tr>
                            <td>content_security_policy.directive.report_uri</td>
                            <td>/vizql/csp-report</td>
                            <td>
                                <p>Instructs the user agent to report attempts to violate the CSP. These violation reports consist of JSON documents sent via an HTTP POST request to the specified URI.</p>
                                <p><a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/report-uri" target="_blank">Valid values for <code>report_uri</code></a>.</p>
                            </td>
                        </tr>
                    </tbody>
                </table>

### Step 2: Add additional directives (optional)

The default directives included with Tableau Server are a subset of directives that are supported by CSP.

For a full list of supported CSP directives, go to [https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy).

You can add directives to the existing default set, by using adding the new directive in the content\_security\_policy.directive namespace. You must include the `--force-keys` parameter when adding new directives. The syntax is as follows:

`tsm configuration set -k content_security_policy.directive.<new_directive_name> -v "<value>" --force-keys`

For example, to add the [`worker-src`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/worker-src) directive, run the following command:

`tsm configuration set -k content_security_policy.directive.worker-src -v "none" --force-keys`

### Step 3: Specify report-only directives (optional)

You can configure CPS to report some directives and to enforce others. When you set content\_security\_policy.enforce\_enabled to true, then all directives are enforced (even if content\_security\_policy.report\_only\_enable is also set to true).

To specify directives as "report-only" and not enforced, add the directives to the report\_only\_directive namespace. You must include the `--force-keys` parameter when adding new directives. The syntax is as follows:

`tsm configuration set -k content_security_policy.report_only_directive.<directive_name> -v "<value>" --force-keys`

For example, to report only on the `script_src` directive, run the following command:

`tsm configuration set -k content_security_policy.report_only_directive.script_src -v " http://*.example.com" --force-keys`

### Step 4: Enable CSP on Tableau Server

After you have configured directives, enable CSP on Tableau Server.

The following options are used to enable enforcement or report only mode for the directives you have set.

<table style="width: 100%;" class="simple-table">
                    <colgroup><col style="width: 45%;">
                    <col style="width: 20%;">
                    <col style="width: 25%;">
                    </colgroup><tbody>
                        <tr>
                            <th>Option</th>
                            <th>Default value</th>
                            <th>
                                <p>Description</p>
                            </th>
                        </tr>
                        <tr>
                            <td>content_security_policy.enforce_enabled</td>
                            <td>false</td>
                            <td>
                                <p>Adds a CSP header to all requests so that any violation will be enforced by the browser.</p>
                            </td>
                        </tr>
                        <tr>
                            <td>content_security_policy.report_only_enabled</td>
                            <td>true</td>
                            <td>Adds a CSP header to all requests so that any violation will be recorded in our vizql-client logs, but will not be enforced by the browser.</td>
                        </tr>
                    </tbody>
                </table>

To enable enforcement of the CSP directives that you've specified, run the following command

`tsm configuration set -k content_security_policy.enforce_enabled -v true`

### Step 5: Run tsm pending-changes apply

When you are finished configuring CSP, run [tsm pending-changes apply](https://help.tableau.com/v0.0/server-linux/en-us/cli_pending-changes.htm#pending-changes-apply).

If the pending changes require a server restart, the `pending-changes apply` command will display a prompt to let you know a restart will occur. This prompt displays even if the server is stopped, but in that case there is no restart. You can suppress the prompt using the `--ignore-prompt` option, but this does not change the restart behavior. If the changes do not require a restart, the changes are applied without a prompt. For more information, see [tsm pending-changes apply](https://help.tableau.com/v0.0/server-linux/en-us/cli_pending-changes.htm#pending-changes-apply).

## View CSP report

To view CSP violations for a given viz, load the viz in a browser that includes developer tools. This example uses the Chrome browser.

1. Load a test viz with violations that is hosted on the Tableau Server deployment where you configured CSP.
2. Enter `CTRL+Shift+I` to open the developer tools in Chrome.
3. Click the **Network** tab.
4. In the **Filter** field, enter `csp-report`, and then click **Find All**.
    
    - If there are no violations then the search will not return any CSP reports.
    - If there are violations, click the Headers tab in the results pane and scroll to the bottom to view **Request Payload**.