Mango is capable of using Content Security Policies (CSP) for improved security. CSP is an added layer of security that helps to detect and mitigate certain types of attacks, including Cross Site Scripting and data injection attacks. These attacks are used for everything from data theft to site defacement or distribution of malware. The basic idea is that Mango will tell your browser which locations it can access and trust.
There are 2 areas that can have policies applied, the legacy UI and the HTML5 UI. Both are available to configure via the env.properties file. There are examples of how to configure these provided in the file. They are both disabled by default.
Some basic examples are given in the env.properties file, for the HTML 5 UI:
style-src 'unsafe-inline' - inline styles are used by AngularJS Material for the dynamic theming
script-src 'unsafe-eval' - needed by Fabric.js used in amCharts for drawing on charts, also gives AngularJS a 30% performance boost
script-src https://cdnjs.cloudflare.com - needed for AngularJS to load locale files from the internet
connect-src ws: wss: - necessary as 'self' does not permit connections to websockets on the same origin, this should be configured to restrict it to your server's actual hostname
img-src data: - allows for small base64 encoded images to be embedded inline into the html
img-src/script-src https://www.google-analytics.com - allows for enabling Google analytics
img-src/script-src https://maps.google.com https://maps.googleapis.com https://maps.gstatic.com - allows for using the Google maps component
style-src/font-src https://fonts.googleapis.com https://fonts.gstatic.com - allows for using Google fonts in dashboards
For the legacy UI:
script-src 'unsafe-inline' - inline scripts are used extensively throughout the Mango legacy UI
script-src 'unsafe-eval' - The Dojo JS library uses eval()
style-src 'unsafe-inline' - inline styles are used throughout the Mango legacy UI
connect-src ws: wss: - necessary as 'self' does not permit connections to websockets on the same origin, this should be configured to restrict it to your server's actual hostname
img-src data: - allows for small base64 encoded images to be embedded inline into the html
img-src/script-src https://www.google-analytics.com - allows for enabling Google analytics