Content Security Policy (CSP) and Custom Scripts
Content Security Policy (CSP) is a web security standard that controls which scripts, stylesheets, and other resources a page is allowed to load or execute. A strict CSP is the most effective defense against Cross-Site Scripting (XSS) attacks.
How CSP affects TheFlex custom scripts
TheFlex injects custom scripts into the WebView at the page level. If the loaded web application defines a CSP, the browser will block the injected script unless the policy explicitly permits it.
The minimum required entry to allow TheFlex's Cordova bridge is:
script-src https://localhost/cordova.jsThis is sufficient to enable all Cordova plugins (NFC, barcode scanning, etc.) within TheFlex.
TIP
Add only what is strictly necessary. Do not use script-src 'unsafe-inline' or script-src * - these disable CSP protection entirely and create XSS vulnerabilities.
Where to set the CSP
The CSP is set by the web application (e.g. your SAP system), not by TheFlex. Depending on the platform:
- SAP S/4HANA Cloud / SAP Fiori: The CSP is configured in the SAP system. See the SAP Help documentation and the SAP Community CSP article.
- Custom web apps: The CSP is typically set as an HTTP response header or a
<meta>tag in the HTML.
FAQ
Why is my custom script not executing in TheFlex?
The most likely cause is an active CSP that does not include https://localhost/cordova.js. Check the browser console (via remote debugging) for a CSP violation message, then add the required entry to your application's policy.
Is it safe to allow all scripts?
No. Only allow the specific sources you need - at minimum https://localhost/cordova.js for TheFlex. Wider rules like 'unsafe-inline' or * eliminate CSP protection and should be avoided.
My script runs fine without CSP but breaks after enabling it - what to check?
Check the browser console for CSP violation reports. Each blocked resource generates a message like:
Refused to execute inline script because it violates the following Content Security Policy directive: "script-src ..."Add only the specific source that is being blocked.
For more on writing and deploying custom scripts, see the Custom Scripts article.