CABI Summary Dashboard not working in chrome
Article ID: 144678
Updated On:
Products
NIMSOFT PROBES
DX Infrastructure Management
Issue/Introduction
Dashboards and reports open normally when launched in Internet Explorer. However, when launching them in Chrome (Operator Console says it only works in Chrome) all you receive is a spinning wheel.
When using the Web Browser's Dev Tools (F12) we see the following errors:
Refused to load the script 'http://UMPServer.domain.com/cabijs/client/visualize.js' because it violates the following Content Security Policy directive: "script-src 'self' https: *.cloud.ca.com *.salesforceliveagent.com *.walkme.com *.ca.com *.cloudfront.net 'unsafe-eval' 'unsafe-inline'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
When using the Web Browser's Dev Tools (F12) we see the following errors:
Refused to load the script 'http://UMPServer.domain.com/cabijs/client/visualize.js' because it violates the following Content Security Policy directive: "script-src 'self' https: *.cloud.ca.com *.salesforceliveagent.com *.walkme.com *.ca.com *.cloudfront.net 'unsafe-eval' 'unsafe-inline'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
Cause
The UMP does not set a Content-Security-Policy in the script source. In this instance the customer environment had a Security Appliance that was inserting a Content-Security-Policy and setting the script-src which causes problems in Chrome and FireFox.
Environment
Release : 9.2.0
Component : UIMCBI
Resolution
Add the following to the included headers page to set the Content-Security-Policy on the UMP server
/nimsoft/probes/service/wasp/webapps/cabi/includes/header.jsp
<head>
<%
// Content-Security-Policy
// Summary: Content Security Policy informs the client about the sources from which the application expects to load
// resources
// Info: https://www.owasp.org/index.php/Content_Security_Policy
response.setHeader("Content-Security-Policy", "script-src 'self' https: 'unsafe-eval' 'unsafe-inline'; img-src 'self' https: data:;");
%>
/nimsoft/probes/service/wasp/webapps/cabi/includes/header.jsp
<head>
<%
// Content-Security-Policy
// Summary: Content Security Policy informs the client about the sources from which the application expects to load
// resources
// Info: https://www.owasp.org/index.php/Content_Security_Policy
response.setHeader("Content-Security-Policy", "script-src 'self' https: 'unsafe-eval' 'unsafe-inline'; img-src 'self' https: data:;");
%>
Feedback
Powered by
