Content Security Policies (CSP)
Managing and interoperating with content security policies
Overview
Transcend Consent Management can optionally generate a Content Security Policy for your site. We can construct this policy using current user consent data in combination with your configured data flows. Note that Regular Expression and Query Parameter data flow rules are not used when generating Content Security Policies.
Content Security Policy (CSP) is a browser feature which can add a layer of security that helps to detect and mitigate certain types of attacks, including Cross Site Scripting (XSS) and data injection attacks.
CSP can be activated by setting your Unknown Request Policy to Block in the Consent Management Developer Settings page of your Admin Dashboard.
CSP Modes
Your CSP mode can be configured via the airgap.js CSP API. Note that your Unknown Request Policy must be set to Block in order to use a CSP.
Lax
Lax mode prevents your visitors from establishing connections to websites that have not been confirmed in your Data Flows. This mode allows for user consent to change without a page refresh. This is the default mode used when Unknown Request Policy is set to Block.
In order to use this mode, specify data-csp="allow-subdomains allow-known-hosts" on your airgap.js script tag.
Strict
Strict mode prevents your visitors from establishing connections to websites (and their subdomains) that are not allowed based on user tracking consent. This mode requires a page refresh whenever user tracking consent changes. This mode can be used to reliably cover all of our direct regulation gaps.
In order to use this mode, specify data-csp="strict" on your airgap.js script tag.
Off
Set data-csp="off" on your airgap.js script tag to disable CSP generation. Transcend Consent Management will still provide protection against most network-based tracking. See our Regulation Roadmap for a list of network interfaces that we do not yet directly regulate without CSP.
Integrating with an existing CSP
Our consent manager connects to the following origins by default. Make sure to add these domains to your existing CSP to ensure that our consent manager can function properly:
- https://transcend-cdn.com — CDN for consent manager resources
- https://cdn.transcend.io — Legacy CDN for consent manager resources. To find out which CDN you're using, please refer to the HTML Snippet that can be found under Developer Settings > Installation.
- https://telemetry.transcend.io — EU Hosting Only - Encountered host telemetry ingestion endpoint (required; set
data-telemetry="usage"to reduce telemetry to just usage data essential for billing). - https://telemetry.us.transcend.io — US Hosting Only - Encountered host telemetry ingestion endpoint (required; set
data-telemetry="usage"to reduce telemetry to just usage data essential for billing)
Limitations
Consent rules can apply to some request hostnames that are not currently possible to be represented by CSP rules. For example, hostname rules containing underscores are ignored by browsers, resulting in potentially blocked content when using a strict CSP. In order to work around the underscore-containing hostname limitation, rules can be specified for the parent domain.