Content security policy (CSP)

Content Security Policy (CSP) is a computer security standard to prevent cross-site scripting, "clickjacking" and other code injection attacks. A CSP policy identifies approved sources of content for a browser to load; any content from other sources are ignored and not loaded.

Note: CSP enforcement is managed by the browser. Most of the recent versions of the popular browsers support CSP. Older versions that do not support CSP ignore the policy directives. For more information about CSP, including a compatibility matrix of common browsers, see the Content Security Policy (CSP) Quick Reference Guide.

Medallia Experience Cloud sends CSP policies for Report web screens.

By default Medallia Experience Cloud sends

a list the URLs to the Medallia servers feeding the report, and
the browser is instructed to NOT enforce the policy.

By customizing the Content security policy configuration, you can:

Add additional URLs of content to load.
Turn on policy enforcement.
Disable sending of policies.

Warning: This is a security feature for users. Only include additional locations that are known to be trusted, and do not disable CSP. If you are unsure, contact Medallia's Security team for assistance.

For information about Medallia Experience Cloud hosts to include in internal company allow-lists, see Medallia Experience Cloud IP addresses and host names.

Properties

Allow-list URLs for images, styles, fonts or frames (default-src)

URLs (one per line) that may host fonts, IFRAMEs, scripts, images, and stylesheets in Medallia custom reports and surveys. Each URL should point to the site's root or a container in the path, but not an absolute file path (such as, https://somesite.com/some/image.png).

This list is appended to the default list of URLs included in the CSP policy's default-src directive. See below for the list of default URLs.

Allow-list URLs for Scripts (script-src)

URLs (one per line) that may host scripts to in Medallia custom reports and surveys.

This list is appended to the default list of URLs included in the CSP policy's script-src directive. See below for the list of default URLs.

Enforce CSP

Turns on CSP so only sites listed in the allow-lists above may supply scripts, fonts, images, stylesheets or frames.

on — sends a Content-Security-Policy directive used for already tested policies.
off — (default) sends a Content-Security-Policy-Report-Only directive used for testing policies.

See Testing CSP policies, below, for more information.

Disable CSP

Stops sending CSP policies.

Warning: Do not disable CSP unless instructed by Medallia's Engineering or Security teams.

CSP allow-lists

An allow-list is a set of approved sources of content. By default the Medallia CSP policies include URLs to the locations serving the basic report elements. However, customized reports might include content and scripts from additional, supplemental locations. Then those additional sources need to be include in the allow-lists defined on this screen.

In the allow-list properties, include one URL per line.

Each URL must include a scheme (that is, https://) and a domain (for example, static.medallia.com), and may contain a port (for example, :443). The scheme and port may use wildcards (*), as may the left-most subdomain in the domain portion. Here are some examples:

https://static.medallia.com
https://static.medallia.com:443
https://*.medallia.com:*

Each URL should point to the site's root or a container in the path, but not an absolute file path (such as https://somesite.com/some/image.png).

https://static.example.com/fonts
https://static.example.com/css
https://static.example.com/medallia-report/images

Example

This illustration shows how allow-list entries are included in the HTTP header sent by Medallia Experience Cloud.

Example HTTP header with the filed values highlighted

Default CSP allow-lists

Medallia Experience Cloud includes these URLs, by default, in the CSP. You do not need to specify these:


What	URLs	default-src	script-src
Where Anti-cheating Engine and other resources are hosted	`static.medallia.com`	X	X
Bug reports URL	`bugreport.medallia.com`	X	X
Google Analytics (fonts, images, script)	`https://www.google-analytics.com/`	X	X
Google Fonts	`https://fonts.gstatic.com/` `https://fonts.googleapis.com/`	X	X
Google Charts	`https://chart.googleapis.com/`	X	X
Codemirror and other JS	`https://cdnjs.cloudflare.com/`	X	X
Bootstrap JS	`https://maxcdn.bootstrapcdn.com/` `https://netdna.bootstrapcdn.com/`	X	X
Medallia’s CDN	`cdn.medallia.com`	X	X
New Relic	`https://nr-data.medallia.com/` `https://bam.nr-data.net/`	—	X

Testing CSP policies

By default, Medallia reports send Report-Only CSP headers to allow the browser to receive and respond to the policy, but not enforce it.

HTTP Response header highlighting Content-Security-Policy-Report-Only

Using your browser's developer tools you can review the browser responses in the browser's log. This example shows the browser refused to execute a couple of scripts:

Browser console showing a Report Only error message

When you are finished, turn on Enforce CSP to instruct the browser to adhere to the policy.