DOCUMENTATION
Sign In

Get access to My SAS, trials, communities and more.

Environment Setup Guide
 

Task 3: Configure the Content Security Policies for Your Web Server

To protect your website from cross-site scripting, clickjacking, and other code injection attacks that are caused by executing malicious content from a trusted web page, you can set up a Content Security Policy (CSP) on your web server. CSPs specify the items that are allowed to be loaded to a web page. CSPs are defined in the web server’s configuration and transmitted in the HTTP header.

If the scripts for SAS Customer Intelligence 360 are not allowed in the CSP configuration for your company’s website, these issues might occur:

  • Your company website cannot be opened in the SAS Customer Intelligence 360 user interface (iframe). For information about resolving this issue, see Task 1: Allow Your Websites to Appear in the SAS Customer Intelligence 360 User Interface.
  • The SAS Customer Intelligence 360 user interface cannot be used to select spots.
  • SAS Customer Intelligence 360 cannot collect data or deliver content.
  • Explicit error messages about the CSP appear in the browser console.

If the page loads in the SAS Customer Intelligence 360 user interface, but you cannot select items in the user interface or error messages are displayed in the browser’s console, your CSP might be too restrictive. You need to modify your security policies to allow the SAS Customer Intelligence 360 script to load so that it can run and deliver content to your site.

To modify your CSP configuration:

  1. Make sure that you configured your CNAMEs. If you configured CNAMEs for SAS Customer Intelligence 360 based on the recommendations in Task 2, you will have CNAMEs similar to these examples:
    • execution-ci360.<customer domain>
    • delivery-ci360.<customer domain>
    • content-ci360.<customer domain>

    This ensures that the scripts for SAS Customer Intelligence 360 come from your site’s domain.

  2. Update your CSP setting to include the CNAMEs and other directives that are required by SAS Customer Intelligence 360. Assuming that you use the CNAME examples from the previous step, you would add these sample entries to your CSP configuration:
    • For SAS 360 Discover, include this directive:
      script-src execution-ci360.<customer domain>; connect-src execution-ci360.<customer domain>;
    • For SAS 360 Foundations, include the directive for SAS 360 Discover and this additional directive:
      script-src 'unsafe-inline' execution-ci360.<customer domain>; img-src content-ci360.<customer domain>;

    This is an example of a sample CSP configuration that contains entries for both SAS 360 Discover and SAS 360 Foundations, with the additions for SAS Customer Intelligence 360 in italics:

    Content-Security-Policy: default-src 'self' data: ; script-src 'self' 'unsafe-inline' execution-ci360.<customer domain>; connect-src 'self' execution-ci360.<customer domain>; img-src 'self' content-ci360.<customer domain>;

    If your site is already using a CSP configuration, add only the relevant changes from the example. If your site is not using a CSP configuration, evaluate how these settings affect your site and your site’s security before you implement them.

    TipFor enhanced security, you can use a nonce value instead of the 'unsafe-inline' directive. With this method, you generate a nonce value programmatically (for example, by using PHP), and set the nonce value in these places:
    • as the nonce attribute on the <script> element that inserts the SAS tag. For example:
      <script nonce="nonce-<generated value>">
// JavaScript snippet for the SAS tag
</script>
    • as a script-src directive in the CSP. For example:
      Content-Security-Policy: script-src 'nonce-<generated value>';

    For more information, see the topics Content-Security-Policy - Other Values (external) and CSP nonce examples (external).

Last updated: August 3, 2026