Skip to content
MDView as Markdown

BigCommerce

BigCommerce lets you set a Content Security Policy for your storefront from the control panel, without a theme change or an app. It is a single field holding the policy value, so everything you want the browser to enforce has to fit in the one string.

What BigCommerce gives you

  • A storefront CSP setting under Settings > Security & Privacy, alongside the other advanced security policies such as X-Frame-Options. Managing storefront settings requires the Manage Channels permission.
  • The same setting exposed through the REST API as csp_header, with an enabled flag and a header_value string, so the policy can be managed in code alongside the rest of your store configuration.
  • Catalyst storefronts ship a default Content Security Policy that can be extended in the codebase rather than the control panel.

Sending reports to Report URI

Add the reporting directives to the policy value in the CSP field. Your URLs come from the Setup page:

default-src 'self'; script-src 'self' 'report-sha256'; report-uri https://abc123.report-uri.com/r/d/csp/enforce; report-to default

report-to sends reports through the Reporting API, which needs two more response headers. The CSP field cannot set them, so add them in front of BigCommerce - see our Cloudflare page:

Reporting-Endpoints: default="https://abc123.report-uri.com/a/d/g"
Report-To: {"group":"default","max_age":31536000,"endpoints":[{"url":"https://abc123.report-uri.com/a/d/g"}],"include_subdomains":true}

'report-sha256' in script-src turns on CSP Integrity, which reports a hash of every script that loads. Without those two headers, report-uri still sends your CSP reports, but CSP Integrity reports are not sent.

Reports are sent by an enforcing policy as well as a report-only one, so you get data from the moment the header goes live.

Things to watch for

  • The setting is for the Content-Security-Policy header and there is no documented report-only toggle. If you want a genuine report-only rollout first, add Content-Security-Policy-Report-Only in front of BigCommerce instead - see our Cloudflare page - and leave the control panel setting switched off until you have tuned the policy.
  • A safe way to start in the control panel is a deliberately permissive policy that still reports, so you collect an inventory of what your storefront loads before you tighten anything.
  • Apps and script manager entries add third-party scripts that will not be in your policy. Expect the first few days of reports to be busy.

Official documentation

BigCommerce - Security and Privacy Settings

Start Monitoring with Report URI

Already using us for CSP? Find your CSP reporting directives on Setup, or view your CSP reports.

New to Report URI? Create an account and grab your CSP reporting directives from the Setup page.

Start your free trial