...
| Cookie | Support | Behaviour |
|---|---|---|
| HttpOnly |  By default | The cookies are not going to be accesible from the JavaScript API. |
| secure | Should be enabled by setting the configuration item "auth_secure_cookie" => "true" in opCommon.json. | This cookie could be sent just in a request ciphered over https protocol. That's the reason why it is not set by default. |
SameSite set to Strict |
| The cookie set to strict means that the browser only sends the cookie if the request was made in the website that originally established the cookie. |
Security Content Policy or Content Security Policy
The Security Content Policy often referred to as Content Security Policy, is a http header that restricts how resources (JavaScript, CSS, Images, etc.) are loaded from allowed sites. It will help to mitigate some attacks of Cross Site Scripting (XSS) and data injection.
Some background information can be found here: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy
The default values can be overwritten setting the configuration item security_content_policy in the configuration file, opCommon.json. The default values re:
| Code Block |
|---|
"connect-src 'self' opmantek.com community.opmantek.com services.opmantek.com ws: wss: maps.google.com maps.gstatic.com; font-src 'self' fonts.gstatic.com; form-action 'self'; frame-ancestors 'none'; frame-src 'none'; manifest-src 'none'; media-src 'none'; object-src 'none'; prefetch-src 'self'; script-src 'self' 'unsafe-eval' 'unsafe-inline' maps.googleapis.com maps.google.com; style-src 'self' fonts.googleapis.com 'unsafe-inline'; worker-src 'self';" |
Depending on what you need to achieve you will need to update your configuration to include some or all of the default options as well as options specific to your environment.