Business Console -> MWS Server and Content-Security-Policy

[Tomasz_Luczak]

Hello All,

When I open my business console login page (http://:/business.console) I see in browser console many CSP (Content Security Policy) errors.

Refused to load the font ‘https://fonts.gstatic.com/s/opensans/v15/mem5YaGs126MiZpBA-UN7rgOXuhpOqc.woff2’ because it violates the following Content Security Policy directive: "default-src ‘self’ http://:…(etc.)…

There are two questions:

1. where in My webMethods Server I can find CSP (Content Security Policy) settings?

2. Is it possible to turn off this request for external opensans file? It’s required by jquery script.

http://:/socialBPMCommonExt/script/jquery/jquery-1.10.2.js

Components:
Business Console 9.12 Portal Fix 12
Business Console 9.12 Runtime Fix 12
My webMethods Server 9.12 Fix20

[Vinay_Kortikere]

Hi Tomasz ,

Looks like this needs to be analyzed, I will get back to you on this . Or can you file a Support Incident with SoftwareAG for this.

Thanks & Regards

Vinay Kortikere

[Tomasz_Luczak]

Response from SAG support:

MWS-21636 (MWS_9.12_Fix10)
My webMethods Server does not provide a policy for content
security.

The issue is resolved. My webMethods Server now provides two
new JVM parameters, which you can add to the
custom_wrapper.conf file to control and configure content
security, as follows:

“com.webMethods.content.security.hosts” - use this parameter to
supply multiple additional allowed hosts, separated by
intervals.

“com.webMethods.content.security.disabled” - set this parameter
to “true” to disable the content security policy.

For more information about working with the custom_wrapper.conf
file, see Administering My webMethods Server.