QPR ProcessAnalyzer Security Hardening - Revision history

Ollvihe: /* HTTP Response Headers */

2026-04-03T23:30:09Z

HTTP Response Headers

← Older revision		Revision as of 23:30, 3 April 2026
Line 83:		Line 83:
	# Content-Security-Policy		# Content-Security-Policy
	#* Name: '''Content-Security-Policy'''		#* Name: '''Content-Security-Policy'''
	#* Value: '''default-src 'none';script-src 'self';style-src 'self' 'unsafe-inline';img-src 'self' data: blob:;connect-src 'self';font-src 'self' data:;manifest-src 'self';child-src 'self';frame-src 'self';object-src 'none';frame-ancestors 'self'; form-action 'none';base-uri 'none';worker-src blob:;'''		#* Value: '''default-src 'none';script-src 'self';style-src 'self' 'unsafe-inline';img-src 'self' data: blob:;connect-src 'self';font-src 'self' data:;manifest-src 'self';child-src 'self';frame-src 'self';object-src 'none';frame-ancestors 'self'; form-action 'none';base-uri 'none';worker-src blob:; upgrade-insecure-requests;'''
	# Strict-Transport-Security		# Strict-Transport-Security
	#* Name: '''Strict-Transport-Security'''		#* Name: '''Strict-Transport-Security'''

Ollvihe: /* Added HTTP Headers */

2025-12-22T14:15:39Z

Added HTTP Headers

← Older revision		Revision as of 14:15, 22 December 2025
Line 83:		Line 83:
	# Content-Security-Policy		# Content-Security-Policy
	#* Name: '''Content-Security-Policy'''		#* Name: '''Content-Security-Policy'''
	#* Value: '''default-src 'none';script-src 'self';style-src 'self' 'unsafe-inline';img-src 'self' data:;connect-src 'self';font-src 'self' data:;manifest-src 'self';child-src 'self';frame-src 'self';object-src 'none';frame-ancestors 'self'; form-action 'none';base-uri 'none';worker-src blob:;'''		#* Value: '''default-src 'none';script-src 'self';style-src 'self' 'unsafe-inline';img-src 'self' data: blob:;connect-src 'self';font-src 'self' data:;manifest-src 'self';child-src 'self';frame-src 'self';object-src 'none';frame-ancestors 'self'; form-action 'none';base-uri 'none';worker-src blob:;'''
	# Strict-Transport-Security		# Strict-Transport-Security
	#* Name: '''Strict-Transport-Security'''		#* Name: '''Strict-Transport-Security'''
Line 113:		Line 113:
	* '''font-src: data:''' directive is used by Syncfusion and Bpmn.io components to embed fonts into CSS, and it cannot be removed.		* '''font-src: data:''' directive is used by Syncfusion and Bpmn.io components to embed fonts into CSS, and it cannot be removed.
	* '''img-src: data:''' directive is needed to show embedded [[Image\|images]] in dashboards. This directive can be removed, if the images are not used.		* '''img-src: data:''' directive is needed to show embedded [[Image\|images]] in dashboards. This directive can be removed, if the images are not used.
			* '''img-src: blob:''' directive is needed for exporting Highcharts visualizations as PNG, JPG and PDF files.
	* '''worker-src blob:''' directive is needed by the Monaco editor (expression language and SQL script code editor). This directive can be removed, if scripts are not edited.		* '''worker-src blob:''' directive is needed by the Monaco editor (expression language and SQL script code editor). This directive can be removed, if scripts are not edited.

Ollvihe: /* Customize Content-Security-Policy Header */

2025-12-22T14:10:35Z

Customize Content-Security-Policy Header

← Older revision		Revision as of 14:10, 22 December 2025
Line 136:		Line 136:
	To modify the Content-Security-Policy, follow these steps:		To modify the Content-Security-Policy, follow these steps:
	* Navigate to the QPR ProcessAnalyzer Server.		* Navigate to the QPR ProcessAnalyzer Server.
	* Open the '''[[/Server_settings_in_appsettings.json\|appsettings.json]]''' file. Locate the ''Content-Security-Policy'' setting within the ''ResponseHeaders'' section and adjust the value as needed.		* Open the '''[[Server_settings_in_appsettings.json\|appsettings.json]]''' file. Locate the ''Content-Security-Policy'' setting within the ''ResponseHeaders'' section and adjust the value as needed.
	* Access the '''web.config''' file in the same directory. Find the '''Content-Security-Policy''' setting within the '''customHeaders''' section and modify the value to match the one in the appsettings.json file.		* Access the '''web.config''' file in the same directory. Find the '''Content-Security-Policy''' setting within the '''customHeaders''' section and modify the value to match the one in the appsettings.json file.
	* Restart the QPR ProcessAnalyzer Server by stopping and starting the IIS application pool.		* Restart the QPR ProcessAnalyzer Server by stopping and starting the IIS application pool.

	[[Category: QPR ProcessAnalyzer]]		[[Category: QPR ProcessAnalyzer]]

Ollvihe: /* Customize Content-Security-Policy Header */

2025-12-22T14:10:12Z

Customize Content-Security-Policy Header

← Older revision		Revision as of 14:10, 22 December 2025
Line 136:		Line 136:
	To modify the Content-Security-Policy, follow these steps:		To modify the Content-Security-Policy, follow these steps:
	* Navigate to the QPR ProcessAnalyzer Server.		* Navigate to the QPR ProcessAnalyzer Server.
	* Open the '''[[~~Installing_QPR_ProcessAnalyzer_Server#Server_settings_file_(appsettings~~.json)\|appsettings.json]]''' file. Locate the ''Content-Security-Policy'' setting within the ''ResponseHeaders'' section and adjust the value as needed.		* Open the '''[[/Server_settings_in_appsettings.json\|appsettings.json]]''' file. Locate the ''Content-Security-Policy'' setting within the ''ResponseHeaders'' section and adjust the value as needed.
	* Access the '''web.config''' file in the same directory. Find the '''Content-Security-Policy''' setting within the '''customHeaders''' section and modify the value to match the one in the appsettings.json file.		* Access the '''web.config''' file in the same directory. Find the '''Content-Security-Policy''' setting within the '''customHeaders''' section and modify the value to match the one in the appsettings.json file.
	* Restart the QPR ProcessAnalyzer Server by stopping and starting the IIS application pool.		* Restart the QPR ProcessAnalyzer Server by stopping and starting the IIS application pool.

	[[Category: QPR ProcessAnalyzer]]		[[Category: QPR ProcessAnalyzer]]

Ollvihe: /* Added HTTP Headers */

2025-11-07T18:30:06Z

Added HTTP Headers

← Older revision		Revision as of 18:30, 7 November 2025
Line 83:		Line 83:
	# Content-Security-Policy		# Content-Security-Policy
	#* Name: '''Content-Security-Policy'''		#* Name: '''Content-Security-Policy'''
	#* Value: '''default-src 'none';script-src 'self';style-src 'self' 'unsafe-inline';img-src 'self' data~~: blob~~:;connect-src 'self';font-src 'self' data:;manifest-src 'self';child-src 'self';frame-src 'self';object-src 'none';frame-ancestors 'self'; form-action 'none';base-uri 'none';worker-src blob:;'''		#* Value: '''default-src 'none';script-src 'self';style-src 'self' 'unsafe-inline';img-src 'self' data:;connect-src 'self';font-src 'self' data:;manifest-src 'self';child-src 'self';frame-src 'self';object-src 'none';frame-ancestors 'self'; form-action 'none';base-uri 'none';worker-src blob:;'''
	# Strict-Transport-Security		# Strict-Transport-Security
	#* Name: '''Strict-Transport-Security'''		#* Name: '''Strict-Transport-Security'''
Line 110:		Line 110:

	Notes about the used Content-Security-Policy directives:		Notes about the used Content-Security-Policy directives:
	* '''style-src 'unsafe-inline'''' directive is needed by style tags embedded into HTML.		* '''style-src 'unsafe-inline'''' directive is needed by style tags embedded into HTML, and it cannot be removed.
	* '''~~img~~-src: data:''' directive is ~~needed~~ to ~~show embedded [[Image\|images]] in dashboards~~.		* '''font-src: data:''' directive is used by Syncfusion and Bpmn.io components to embed fonts into CSS, and it cannot be removed.
	* '''img-src: ~~blob~~:''' directive is ~~used when downloading dynamically generated files, such as~~ dashboards, ~~datatables and filters (using~~ the ~~URL.createObjectURL() call).~~		* '''img-src: data:''' directive is needed to show embedded [[Image\|images]] in dashboards. This directive can be removed, if the images are not used.
	* '''font-src: data:''' directive is used ~~by Syncfusion and Bpmn.io components to embed fonts into CSS~~.		* '''worker-src blob:''' directive is needed by the Monaco editor (expression language and SQL script code editor). This directive can be removed, if scripts are not edited.
	* '''worker-src blob:''' directive is needed by the Monaco editor (expression language and SQL script code editor).

	Notes about Content-Security-Policy directives that are not used:		Notes about Content-Security-Policy directives that are not used:
	* '''plugin-types''' directive is not needed because it's only used when allowing plugins with object-src directive.		* '''plugin-types''' directive is not needed because it's only used when allowing plugins with object-src directive.
	* '''sandbox''' directive is not required because by default everything is disabled.		* '''sandbox''' directive is not required because by default everything is disabled.
	* '''report-uri''' directive is deprecated ~~and should~~ not be used.		* '''report-uri''' directive is deprecated, so it's not used.

	More information:		More information:

Ollvihe: /* Added HTTP Headers */

2025-11-02T22:40:49Z

Added HTTP Headers

@@ Line 90: / Line 90: @@
 #* Name: '''X-Content-Type-Options'''
 #* Value: '''nosniff'''
 Notes about the used Content-Security-Policy directives:

Ollvihe: /* HTTP Response Headers */

2025-10-27T22:17:25Z

HTTP Response Headers

← Older revision		Revision as of 22:17, 27 October 2025
Line 77:		Line 77:

	==HTTP Response Headers==		==HTTP Response Headers==
	This section contains information about ~~added or removed~~ HTTP response headers that are ~~related security~~.		This section contains information about security related HTTP response headers that are added or removed in the default installation.

	=== Added HTTP Headers ===		=== Added HTTP Headers ===
Line 83:		Line 83:
	# Content-Security-Policy		# Content-Security-Policy
	#* Name: '''Content-Security-Policy'''		#* Name: '''Content-Security-Policy'''
	#* Value: '''default-src 'none';script-src 'self~~' 'unsafe-eval~~';style-src 'self' 'unsafe-inline';img-src 'self' data: blob:;connect-src 'self';font-src 'self' data:;manifest-src 'self';child-src 'self';frame-src 'self';object-src 'none';frame-ancestors 'self'; form-action 'none';base-uri 'none';worker-src blob:;'''		#* Value: '''default-src 'none';script-src 'self';style-src 'self' 'unsafe-inline';img-src 'self' data: blob:;connect-src 'self';font-src 'self' data:;manifest-src 'self';child-src 'self';frame-src 'self';object-src 'none';frame-ancestors 'self'; form-action 'none';base-uri 'none';worker-src blob:;'''
	# Strict-Transport-Security ~~(Note: HTTPS is required)~~		# Strict-Transport-Security
	#* Name: '''Strict-Transport-Security'''		#* Name: '''Strict-Transport-Security'''
	#* Value: '''max-age=31536000; includeSubDomains'''		#* Value: '''max-age=31536000; includeSubDomains'''
Line 92:		Line 92:

	Notes about the used Content-Security-Policy directives:		Notes about the used Content-Security-Policy directives:
	* '''script-src 'unsafe-eval'''' directive is needed by the Syncfusion table component to evaluate dynamic column templates.		* '''style-src 'unsafe-inline'''' directive is needed by style tags embedded into HTML.
	* '''style-src 'unsafe-inline'''' directive is needed by style tags embedded into HTML ~~code~~.
	* '''img-src: data:''' directive is needed to show embedded [[Image\|images]] in dashboards.		* '''img-src: data:''' directive is needed to show embedded [[Image\|images]] in dashboards.
	* '''img-src: blob:''' directive is used when downloading dynamically generated files, such as dashboards, datatables and filters (using the URL.createObjectURL() call).		* '''img-src: blob:''' directive is used when downloading dynamically generated files, such as dashboards, datatables and filters (using the URL.createObjectURL() call).

Ollvihe: /* Added HTTP Headers */

2025-10-08T11:44:46Z

Added HTTP Headers

← Older revision		Revision as of 11:44, 8 October 2025
Line 95:		Line 95:
	* '''style-src 'unsafe-inline'''' directive is needed by style tags embedded into HTML code.		* '''style-src 'unsafe-inline'''' directive is needed by style tags embedded into HTML code.
	* '''img-src: data:''' directive is needed to show embedded [[Image\|images]] in dashboards.		* '''img-src: data:''' directive is needed to show embedded [[Image\|images]] in dashboards.
	* '''img-src: blob:''' directive is used when downloading dynamically generated files ~~with~~ the URL.createObjectURL() call.		* '''img-src: blob:''' directive is used when downloading dynamically generated files, such as dashboards, datatables and filters (using the URL.createObjectURL() call).
	* '''font-src: data:''' directive is used by Syncfusion and Bpmn.io components to embed fonts into CSS.		* '''font-src: data:''' directive is used by Syncfusion and Bpmn.io components to embed fonts into CSS.
	* '''worker-src blob:''' directive is needed by the Monaco editor (expression language and SQL script code editor).		* '''worker-src blob:''' directive is needed by the Monaco editor (expression language and SQL script code editor).

Ollvihe: /* HTTP Response Headers */

2025-10-08T11:31:52Z

HTTP Response Headers

← Older revision		Revision as of 11:31, 8 October 2025
Line 91:		Line 91:
	#* Value: '''nosniff'''		#* Value: '''nosniff'''

	Notes about the used Content-Security-Policy ~~header~~:		Notes about the used Content-Security-Policy directives:
	* '''script-src 'unsafe-eval'''' directive is needed by the Syncfusion table component to evaluate dynamic column templates.		* '''script-src 'unsafe-eval'''' directive is needed by the Syncfusion table component to evaluate dynamic column templates.
	* '''style-src 'unsafe-inline'''' directive is needed by style tags embedded into HTML code.		* '''style-src 'unsafe-inline'''' directive is needed by style tags embedded into HTML code.
Line 97:		Line 97:
	* '''img-src: blob:''' directive is used when downloading dynamically generated files with the URL.createObjectURL() call.		* '''img-src: blob:''' directive is used when downloading dynamically generated files with the URL.createObjectURL() call.
	* '''font-src: data:''' directive is used by Syncfusion and Bpmn.io components to embed fonts into CSS.		* '''font-src: data:''' directive is used by Syncfusion and Bpmn.io components to embed fonts into CSS.
			* '''worker-src blob:''' directive is needed by the Monaco editor (expression language and SQL script code editor).

			Notes about Content-Security-Policy directives that are not used:
			* '''plugin-types''' directive is not needed because it's only used when allowing plugins with object-src directive.
	* '''sandbox''' directive is not required because by default everything is disabled.		* '''sandbox''' directive is not required because by default everything is disabled.
	* '''plugin-types''' directive is not needed because it's only used when allowing plugins with object-src directive.
	* '''report-uri''' directive is deprecated and should not be used.		* '''report-uri''' directive is deprecated and should not be used.
	* '''worker-src blob:''' directive is needed by the Monaco editor (expression language and SQL script code editor).

	More information:		More information:

Ollvihe: /* Added HTTP Headers */

2025-10-08T11:29:59Z

Added HTTP Headers

← Older revision		Revision as of 11:29, 8 October 2025
Line 92:		Line 92:

	Notes about the used Content-Security-Policy header:		Notes about the used Content-Security-Policy header:
	* '''script-src 'unsafe-eval'''' directive is needed by Syncfusion ~~components~~.		* '''script-src 'unsafe-eval'''' directive is needed by the Syncfusion table component to evaluate dynamic column templates.
	* '''style-src 'unsafe-inline'''' directive is needed by ~~CSS definitions~~ embedded into HTML code.		* '''style-src 'unsafe-inline'''' directive is needed by style tags embedded into HTML code.
	* '''img-src: data:''' directive is needed to show embedded [[Image\|images]] in dashboards.		* '''img-src: data:''' directive is needed to show embedded [[Image\|images]] in dashboards.
	* '''img-src: blob:''' directive is used when downloading dynamically generated files with the URL.createObjectURL() call.		* '''img-src: blob:''' directive is used when downloading dynamically generated files with the URL.createObjectURL() call.