Configuring Content Security Policy (CSP) for Adobe Experience Platform Tags

Introduction

A Content Security Policy (CSP) is a crucial security feature that protects against cross-site scripting (XSS) attacks by defining trusted sources for scripts in web applications. Implementing CSPs ensures that browsers only execute scripts from specified, trusted sources, mitigating the risk of malicious script execution.

Overview of CSP and Adobe Experience Platform Tags

CSPs can pose challenges when integrating with Adobe Experience Platform Tags, a system designed to dynamically load scripts. Default CSP configurations often block dynamically loaded scripts, which impacts the functionality of Adobe tags. This guide outlines how to configure CSP to allow Adobe tags while maintaining robust security measures.

Key Challenges

To effectively use Adobe tags with CSP, two primary challenges must be addressed:

1. Trusted Sources for Tag Libraries: Ensure that the source hosting your tag library is trusted by the CSP.
2. Allowing Inline Scripts: Permit inline scripts necessary for Custom Code rule actions to execute properly.

Configuring CSP for Adobe Tags

Add Tags as a Trusted Source

To allow Adobe tags to function under CSP, you need to specify trusted domains where scripts can be loaded. Depending on your hosting setup, you can configure CSP via HTTP headers or within HTML <meta> tags.

Self-hosting:

If you self-host your tag library, configure CSP as follows:

• HTTP header:

css

Copy code

Content-Security-Policy: script-src ‘self’

• HTML <meta> tag:

html

Copy code

<meta http-equiv=”Content-Security-Policy” content=”script-src ‘self’”>

Adobe-managed hosting:

If your tag library is hosted on assets.adobedtm.com (Adobe-managed host), configure CSP as follows:

• HTTP header:

css

Copy code

Content-Security-Policy: script-src ‘self’ assets.adobedtm.com

• HTML <meta> tag:

html

Copy code

<meta http-equiv=”Content-Security-Policy” content=”script-src ‘self’ assets.adobedtm.com”>

Important: Ensure that the tag library is loaded asynchronously. Synchronous loading can lead to console errors and prevent rules from executing properly.

Conclusion

Effectively configuring CSP for Adobe Experience Platform Tags involves specifying trusted sources and allowing necessary inline scripts while maintaining robust security practices. By following these guidelines, developers can ensure that Adobe tags function correctly without compromising website security.