[LF7.x] CSP compatibility https://liferay.dev/c/message_boards/find_thread?p_l_id=119785294&threadId=121507365 2026-04-04T06:21:28Z 2026-04-04T06:21:28Z Zsigmond Rab https://liferay.dev/c/message_boards/find_message?p_l_id=119785294&messageId=121507786 2022-09-02T17:43:18Z 2022-09-02T17:43:17Z

<p>Hi Tinfo,</p> <p>Making the portal CSP compliant is one of our next enhancements. You can watch the https://issues.liferay.com/browse/LPS-134060 ticket for updates.</p> <p>That is also planned to cover what to do with inline scripts and styles at a point.</p> <p>I personally appreciate if you can share any experiences, further needs that you think we should consider in the implementation. I mean, beyond what is needed to be implemented for being compliant with the standard.</p> <p>Thanks,</p> <p>Zsigmond</p>

Zsigmond Rab 2022-09-02T17:43:17Z Tinfo Tinfo https://liferay.dev/c/message_boards/find_message?p_l_id=119785294&messageId=121507364 2022-09-02T09:02:34Z 2022-09-02T09:02:34Z

<p>Hello,</p> <p>is Liferay Portal CSP compliant?</p> <p>Actually if we try to add CSP directive</p> <pre> <code class="language-java">Content-Security-Policy: script-src 'self';</code></pre> <p>the portal loads with lots of errors in browser console like these:</p> <pre> <code class="language-java">Content Security Policy: The page's settings blocked the loading of a resource at inline (&quot;script-src&quot;) Uncaught ReferenceError: Liferay is not defined Uncaught ReferenceError: AUI is not defined</code></pre> <p>We are missing something?</p> <p>Is there any plan in the future to make Liferay Portal CSP compliant by removing all inline script and style? </p>

Tinfo Tinfo 2022-09-02T09:02:34Z