Content Security Policy

Accurids sends a Content-Security-Policy (CSP) header with every response to mitigate cross-site scripting and related attacks. Alongside it, Accurids also sets Referrer-Policy and Permissions-Policy headers. In most deployments the defaults are appropriate and no configuration is required.

Configuration variables

Variable	default value	Description
accurids.csp.mode	report_only	Controls how the CSP header is applied. One of disabled (no CSP header is sent), report_only (violations are reported to the server but not blocked) or enabled (violations are blocked).
accurids.csp.allow-external-images	true	When true, images may be loaded from any external HTTPS source (the img-src directive is widened to include https:). When false, only images from the Accurids instance itself, as well as data: and blob: images, are allowed.

CSP modes

• report_only (default): The browser evaluates the policy and reports violations, but still loads the affected resources. Violation reports are logged by Accurids. This mode is recommended when first rolling out CSP so you can identify resources that would be blocked before enforcing the policy.
• enabled: The browser blocks resources that violate the policy. Use this once you have verified that no required resources are being reported as violations.
• disabled: No CSP header is sent at all.

External images

By default Accurids allows images to be loaded from any external HTTPS source, so that content referencing externally hosted images renders correctly. If your deployment should only display images served from the Accurids instance itself, set accurids.csp.allow-external-images to false.

Note

External images are only permitted over HTTPS. Images served over plain HTTP are blocked regardless of this setting to avoid mixed-content warnings.