How do I secure coach views and REST calls against a strict Content Security Policy and clickjacking headers on BAW?

Question

Security asked us to add Content-Security-Policy and X-Frame-Options headers on the BAW web tier. After that, coaches with inline scripts broke and the portal iframe stopped rendering. What is compatible with coaches and what needs code changes?

Answer 1

Coaches are generated pages with inline scripts and inline styles, rendered inside iframes by the portal - a strict CSP breaks both unless you tune it:

• X-Frame-Options / frame-ancestors: the portal (and Workplace) load coaches in iframes of the same origin; X-Frame-Options: SAMEORIGIN (or Content-Security-Policy: frame-ancestors 'self') is safe; DENY breaks task rendering. If coaches are embedded in another domain (a portal, SharePoint), add that origin to frame-ancestors.
• script-src: coach views use inline event handlers and inline <script> blocks generated by the framework, plus Dojo's eval-based loading on older releases: script-src 'self' 'unsafe-inline' 'unsafe-eval' is the practical minimum on 8.5.x - 20.x; BAW 21+ / CP4BA reduced the inline usage and the Zen front door ships its own CSP (do not add a second stricter one in front). A nonce-based policy is not possible because you do not control the generated markup.
• style-src: 'self' 'unsafe-inline' (control widths / visibility are inline styles).
• connect-src: 'self' plus any external API the coaches call directly (better: route them through service flows, then 'self' is enough).
• img-src / font-src: 'self' data: (icons and fonts of the UI Toolkit are data URIs and zip assets).

# IHS httpd.conf - a policy that keeps coaches working
Header always set X-Frame-Options "SAMEORIGIN"
Header always set X-Content-Type-Options "nosniff"
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
Header always set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self' data:; connect-src 'self'; frame-ancestors 'self'"
Header always set Referrer-Policy "strict-origin-when-cross-origin" 

Code changes that let you tighten later: move inline <script> tags out of coach view HTML into the view's JavaScript sections; load libraries as managed assets (same origin) instead of CDNs; replace onclick="…" attributes with listeners in load; call external APIs through service flows. Test with Content-Security-Policy-Report-Only first and read the browser console violations before enforcing. On CP4BA the platform's headers are set by the operator / router; customise through the CR's route annotations, not with a reverse proxy that strips or duplicates them.

References

• BAW documentation - securing Business Automation Workflow (web tier headers)
• CP4BA - security configuration