- URL:
- https://<root>/security/config/updateContentSecurityPolicy
- Methods:
POST- Version Introduced:
- 11.5
Access requirements
Required privileges
The Sever Administrator API requires privilege-based access. An administrator must be assigned a specific user privilege, or role, to access any given endpoint. Listed below are the user privileges or roles an administrator can be assigned that provides access to this endpoint. If multiple privileges are listed, only one needs to be assigned to gain access.
Note that administrators assigned a custom role must also have the administrative View all content privilege assigned to them to access the API directory as an administrator.
Tokens
This API requires token-based authentication. A token is automatically generated for administrators who sign in to the Server Administrator API directory's HTML interface. Tokens generated in this way are stored for the entirety of the session.
Those accessing the API directory outside of the HTML interface will need to acquire a session token from the generate operation in the Portal Directory API. For security reasons, all POST requests made to the Server Administrator API must include a token in the request body.
Description
The update operation updates the Content-Security-Policy (CSP) response headers that are included when accessing different components of ArcGIS Server.
Currently, this operation only supports setting one CSP response header. When set, this response header is applied to each HTML page in the Services Directory and prevents the JavaScript used in XSS attacks from running, which allows organizations to protect themselves from XSS attacks while keeping the HTML view of the Services Directory enabled.
Request parameters
| Parameter | Details |
|---|---|
(Required) | A JSON object that specifies the Content-Security-Policy response headers being applied. Currently, this property only supports defining the CSP response header for |
| The response format. The default format is Values: |
Example usage
The following is a sample POST request for the update operation:
POST /<context>/admin/security/config/updateContentSecurityPolicy HTTP/1.1
Host: organization.example.com
Content-Type: application/x-www-form-urlencoded
Content-Length: []
contentSecurityPolicy={"rest": "script-src 'self';"}&f=pjsonJSON Response example
{"status": "success"}