1. Implementing Your Cloud Integrations
  2. Setting Up Content Security Policy for Map Services

Setting Up Content Security Policy for Map Services

Content Security Policy (CSP) helps protect the application by controlling the external resources that a browser can load. To use map services that access external URLs, you must add the origins for those URLs to the applicable Oracle Permitting and Licensing profile options.

Adding the origins allows CSP to connect to the external map service and load images from it. If the required origins aren't allowlisted, GIS map functionality might not load.

For map services, add the applicable origins to both the ORA_OPAL_ALLOWED_CONNECT_SRC and ORA_OPAL_ALLOWED_IMG_SRC profile options.

To add map service origins to the profile options:

  1. Access the Functional Setup Manager by selecting Setup and Maintenance in the user's Settings and Actions menu.

  2. Click the Tasks panel tab: Tasks panel tab

  3. Select the Search link in the menu.

  4. On the Search page, enter "Manage Administrator Profile Values" and click the search icon.

  5. Click the Manage Administrator Profile Values task link.

  6. In the Search: Profile Option section on the Manage Administrator Profile Values page, enter this in the Profile Option Code field: ORA_OPAL_ALLOWED_CONNECT_SRC

  7. Click Search.

  8. Select the ORA_OPAL_ALLOWED_CONNECT_SRC profile option in the results.

  9. In the Profile Values section, enter the origins for the external URLs used by your map services:

    • If a row with a Profile Level of Site exists, enter the origins in the Profile Value field.

    • If a row with a Profile Level of Site doesn't exist, add a row, select Site as the profile level, and enter the origins in the Profile Value field.

    If you have more than one origin, enter the values as a space-separated list.

  10. Click Save.

  11. Search for and select the ORA_OPAL_ALLOWED_IMG_SRC profile option.

  12. At the Site profile level, enter the applicable map service origins as a space-separated list.

  13. Click Save.

Content Security Policy Profile Options

The following profile options specify the domains that can be allowlisted for different types of external resources. In addition to map service origins, you can add other applicable external URLs to the ORA_OPAL_ALLOWED_CONNECT_SRC and ORA_OPAL_ALLOWED_IMG_SRC profile options as needed.

Profile Option Code

Description
ORA_OPAL_ALLOWED_CONNECT_SRC

Specifies a space-separated list of domains that are valid sources for AJAX, XHR, and fetch requests.
ORA_OPAL_ALLOWED_FONT_SRC

Specifies a space-separated list of domains that are valid sources for fonts.
ORA_OPAL_ALLOWED_FRAME_SRC

Specifies a space-separated list of domains that are valid sources for iframes.
ORA_OPAL_ALLOWED_IMG_SRC

Specifies a space-separated list of domains that are valid sources for images and favicons.
ORA_OPAL_ALLOWED_MEDIA_SRC

Specifies a space-separated list of domains that are valid sources for media loaded using audio and video elements.
ORA_OPAL_ALLOWED_SCRIPT_SRC

Specifies a space-separated list of domains that are valid sources for JavaScript.
ORA_OPAL_ALLOWED_STYLE_SRC

Specifies a space-separated list of domains that are valid sources for style sheets.
ORA_OPAL_ALLOWED_WORKER_SRC

Specifies a space-separated list of domains that are valid sources for Worker, SharedWorker, or ServiceWorker scripts.