Skip to content
MDView as Markdown

Dynamics 365 Commerce

Dynamics 365 Commerce turns CSP on by default for ecommerce sites and ships a default list of allowed sources for scripts, styles and API calls. Everything is managed from site builder rather than from headers you write yourself, and most sites will need to extend that default list before pages behave correctly.

What Dynamics 365 Commerce gives you

  • A Content security policy tab under Site settings > Extensions in site builder, with per-directive lists you add source URLs to.
  • An Enable report only mode checkbox. The browser stops enforcing the policy and reports violations to the URI in the report-uri directive instead - exactly what you want for a first rollout.
  • An Enable Nonce checkbox, which generates a unique nonce per script in the CSP header and blocks inline scripts other than those added through the inline script module.
  • A Disable content security policy checkbox if you need to turn it off for a site entirely.
  • Directive-level control over script-src, style-src, connect-src, font-src, img-src, media-src, child-src, frame-src, frame-ancestors, object-src and report-uri.

Sending reports to Report URI

Add your URL to the report-uri directive on the Content security policy tab, then Save and publish. Your URL comes from the Setup page:

https://abc123.report-uri.com/r/d/csp/reportOnly

Turn on Enable report only mode at the same time so you are collecting reports without blocking anything, then switch to the enforce endpoint when you take report-only mode back off.

Things to watch for

  • CSP is on by default, so a site can be blocking resources before anyone has thought about a policy. If pages are half-broken after a deployment, check this tab before anything else.
  • eval() is blocked by default. Adding 'unsafe-eval' to script-src fixes it, but it is a real weakening of the policy - prefer removing the dependency on eval().
  • Page mocks used with the online SDK do not inherit the platform's default policies when you define contentSecurityPolicy in appContext, so a mock is not a reliable preview of production behaviour.

Official documentation

Microsoft - Manage Content Security Policy (CSP)

Start Monitoring with Report URI

Already using us for CSP? Find your report-uri value on Setup, or view your CSP reports.

New to Report URI? Create an account and grab your report-uri value from the Setup page.

Start your free trial