2742494 - How to Enable Content Security Policy (CSP)

How to Enable Content Security Policy (CSP) for SuccessFactors

 SAP SuccessFactors HCM Suite

Content Security Policy (CSP) is an added layer of security that helps to detect and mitigate certain types of attacks, including Cross Site Scripting (XSS) and data injection attacks. These attacks are used for everything from data theft to site defacement or distribution of malware.

• CSP is a response header returned by server, which includes a set of rules, that instructs the browser which sources, destinations, and protocols are permitted for each type of resource.

Advantages of enabling CSP:

1. CSP provides a second line of defense against cross site scripting vulnerabilities that happen despite our best efforts and practices.
2. It can also protect end users from some types of malicious browser plugins, malware, and compromised JavaScript dependencies.
3. It provides client browser the ability to restricted and control the loading of almost all kinds of the resource (HttpOnly, X-Frame-Options, XSS)

Please note we migrated the CSP configurations from Provisioning > Application Security Settings to Admin Center > Application Security Feature Settings, making the original Provisioning settings invalid and no longer configurable. In 1H 2026, we removed these settings from Provisioning.

To enable it now, you must have the Administrator Permissions > Manage Security > Manage Application Security Feature Settings permission.

• Content-Security-Policy-Report-Only

CSP provides a passive mode to get warnings only if there is any rule violation, without blocking the load of the resources. Simply appending "-Report-Only" after the CSP header will make the trick. A "report-uri" should be defined in the header value to determine which end point should the browser send the warning to:

• Help Portal - Content Security Policy
• Help Portal - SAP SuccessFactors Security Recommendations

CSP, Content Security Policy (CSP), sf, successfactors, security, layer, protection, content, policy. , KBA , LOD-SF-PLT-PSI , Product Security Inquiries , LOD-SF-PLT , Platform Foundational Capabilities , How To