Content Security Policy configuration conflicts in AEM
Strict Content Security Policy (CSP) rules often break the AEM Author UI, trigger scanner warnings about missing CSP headers, or cause deployment issues when CSP is applied across Author and Publish environments. Configure CSP on the Dispatcher or CDN layer, exempt Author environments from strict policies, and apply CSP only where required.
Description description
Environment
- Adobe Experience Manager as a Cloud Service (AEMaaCS)
- AEM Managed Services
- Adobe Developer App Builder
Issue/Symptoms
- Author UI toolbars, components, or iframes fail to load.
- Security scanners report missing CSP headers on login pages.
- Sites stop functioning after applying restrictive CSP directives such as default-src ‘self’.
- CSP directives that restrict unsafe-inline or unsafe-eval cause UI failures.
- No built-in CSP reporting endpoint is available.
Cause
AEM does not provide comprehensive CSP support out of the box. Many core client libraries depend on inline JavaScript and behaviors that are incompatible with strict CSP policies. Applying CSP globally can unintentionally affect Author environments. CSP nonces are not generated by default and require custom implementation. Login pages also do not include CSP headers by default.
Resolution resolution
To resolve this issue, follow these steps:
- Identify where the CSP header is configured, such as the CDN, Dispatcher, or reverse proxy layer.
- Use separate hostnames for Author and Publish environments.
- Remove or exempt CSP headers from Author environments to prevent authoring interface failures.
- Apply CSP only to Publish environments.
- If stricter policies are required, use domain whitelisting or implement a custom nonce solution.
- Host CSP reporting endpoints outside the platform if reporting is required.
- Apply CSP at the outermost layer, such as the CDN or reverse proxy, for consistent enforcement.
- Add CSP headers to login pages only when required to satisfy security scanning requirements.
- Validate the configuration by confirming that required resources load successfully and no critical CSP violations occur.