Page Protect

Overview

Page Protect provides Content Security Policy (CSP) management, security headers, and script allowlisting for protecting web applications from client-side attacks like XSS, clickjacking, and data exfiltration.

CSP Management

Content Security Policy headers control which resources the browser is allowed to load. coreX Manager lets you configure CSP per listener with granular control over each directive.

CSP Directives

Directive	Controls
default-src	Fallback for all resource types
script-src	JavaScript sources
style-src	Stylesheet sources
img-src	Image sources
font-src	Font sources
frame-src	Iframe sources
connect-src	XHR, WebSocket, fetch destinations
media-src	Audio/video sources
object-src	Plugin/embed sources
frame-ancestors	Who can embed this page (clickjacking protection)
base-uri	Allowed <base> tag URIs
form-action	Form submission destinations

Each directive accepts:

• self — same origin
• none — no sources
• Specific URLs
• Nonces (per-request generated)
• Hashes

Security Headers

In addition to CSP, Page Protect manages standard security headers:

Header	Description
X-Content-Type-Options	Prevent MIME type sniffing (nosniff)
X-Frame-Options	Clickjacking protection (DENY or SAMEORIGIN)
Strict-Transport-Security	HSTS (also configurable in TLS settings)
Referrer-Policy	Control referrer header leakage
Permissions-Policy	Control browser feature access (camera, mic, geolocation, etc.)

Script Allowlisting

Page Protect maintains an allowlist of permitted script sources. Scripts not on the allowlist are blocked by the CSP script-src directive.

Managing the Allowlist

1. Navigate to Protection > Page Protect > Scripts
2. Click Add Script Source
3. Enter the script URL or hash
4. Select the listener(s) it applies to
5. Save

CSP Violation Reporting

When a browser detects a CSP violation, it can send a report to a configured endpoint. coreX Manager receives and logs these reports.

Enabling Violation Reports

1. Navigate to Protection > Page Protect > CSP
2. Set the report-uri or report-to directive to the coreX Manager violation endpoint
3. Enable Report Only mode initially to collect violations without blocking

Reviewing Violations

Navigate to Protection > Page Protect > Violations to see:

• Violated directive
• Blocked URI
• Source file and line number
• Client IP
• Timestamp

Step-by-Step: Configure CSP for a Listener

1. Navigate to Protection > Page Protect > CSP
2. Select the listener
3. Set default-src to self
4. Set script-src to self plus any allowed CDN URLs
5. Set style-src to self plus any allowed CDN URLs
6. Set img-src to self data: (if using data URIs)
7. Set frame-ancestors to none (clickjacking protection)
8. Enable Report Only mode
9. Save and Apply

Step-by-Step: Add Security Headers

1. Navigate to Protection > Page Protect > Headers
2. Enable X-Content-Type-Options (nosniff)
3. Enable X-Frame-Options (DENY)
4. Enable Referrer-Policy (strict-origin-when-cross-origin)
5. Enable Permissions-Policy and disable unused features (camera, microphone, geolocation)
6. Save and Apply

Step-by-Step: Review and Enforce

1. After running in Report-Only mode for a period:
2. Navigate to Protection > Page Protect > Violations
3. Review reported violations
4. Add missing sources to the CSP allowlist
5. Once violations stop, switch from Report-Only to enforcement
6. Apply Changes

Verification

1. Check CSP header:

   curl -k -sI https://localhost/ | grep -i content-security-policy

2. Check security headers:

   curl -k -sI https://localhost/ | grep -iE 'x-content-type|x-frame|referrer|permissions'

3. Test violation reporting:

   • Open your site in a browser
   • Open developer tools > Console
   • Look for CSP violation reports
   • Verify violations appear in the Page Protect > Violations page

4. Test enforcement:

   • Once in enforcement mode, attempt to load a non-allowlisted script
   • Verify the browser blocks it

Next Steps

• Certificates & TLS — Configure HSTS alongside CSP
• Security Rules — Layer access control
• Metrics & Logging — Monitor CSP violations