Update Content Security Policy

Description

The updateContentSecurityPolicy operation updates the Content-Security-Policy (CSP) response headers that are included when accessing different components of ArcGIS Server.

Currently, this operation only supports setting one CSP response header. When set, this response header is applied to each HTML page in the Services Directory and prevents the JavaScript used in XSS attacks from running, which allows organizations to protect themselves from XSS attacks while keeping the HTML view of the Services Directory enabled.

Request parameters

1
contentSecurityPolicy={"rest": "script-src 'self';"}

Example usage

The following is a sample POST request for the updateContentSecurityPolicy operation:

1
2
3
4
5
6
POST /<context>/admin/security/config/updateContentSecurityPolicy HTTP/1.1
Host: organization.example.com
Content-Type: application/x-www-form-urlencoded
Content-Length: []

contentSecurityPolicy={"rest": "script-src 'self';"}&f=pjson

JSON Response example

1
{"status": "success"}