After finding a couple of suspicious files on our web sever I've been working to try and find ways to tighten up the security. I'm looking at trying to configure a Content Security Policy.

I'm already using the Security Kit module 7.x-1.11 for Drupal to enforce HTTPS, so I've enabled its built in CSP features as well. To it running fine in reports only mode I've had to allow unsafe-inline for style and script, which isn't ideal, but I figure it's better than nothing.

Turning off reports only works fine for our Drupal site, but as soon as I do that CiviCRM isn't displaying correctly. I have console errors that say things like:

[Error] EvalError: Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline'".

    eval (jquery.ui.datepicker.validation.min.js:7)
    Global Code (jquery.ui.datepicker.validation.min.js:7)

Obviously I could add unsafe-eval on scripts, but at that point it seems like the CSP is barely worth having. Is there a safe way of configuring CSP that works with Drupal 7/CiviCRM?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.