on - edited on by
HannahM
Summary
Content Security Policy (CSP) is a security layer that helps detect and mitigate specific types of attacks, such as Cross-Site Scripting (XSS) and data-injection attacks.
Unfortunately, the applied CSP settings are likely to prevent the browser from sending monitoring data to the Dynatrace Cluster.
Preferred solution: Monitor settings
As a first and preferred method to bypass the CSP of any monitored pages in your single-URL browser monitor or browser clickpath, enable Bypass Content Security Policy (CSP) of monitored pages in monitor settings. You can do this in Additional options when creating a browser monitor or in Advanced setup in monitor settings in edit mode.
If you're unable to use this option for some reason, refer to the advanced methods for bypassing CSP below.
Advanced methods to bypass CSP
Your CSP rules, such as the following, prevent Dynatrace from sending requests to a path relative to the page URL.
"Content-Security-Policy: default-src https: data: 'unsafe-inline' 'unsafe-eval'"
If you use custom JavaScript events, you may see the following JavaScript error.
Uncaught EvalError: Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed. To avoid this, your page needs to allow script-src unsafe-eval.
In other cases, you must modify the page to allow connections relative to the URL. The following are example scenarios.
Example 1
CSP settings specified by using the <meta> tag are likely to prevent the browser from sending monitoring data to Dynatrace Cluster.
To resolve this issue, you can either set up a CSP HTTP header by replacing any existing CSP <meta> tag or add your environment URL to CSP, as shown below.
<meta
http-equiv="Content-Security-Policy" content="default-src 'self';
connect-src 'self' https://{your environment id}.live.dynatrace.com">
Example 2
A page loaded from http://www.mydomain.com returns no data in the UI because the CSP settings specify connect-src https://.
In such a case, you can try either of the following.
-Add http:// to connect-src.
-Switch the test to load https://www.mydomain.com instead of http://www.mydomain.com.
Example 3
A page loaded from http://www.mydomain.com returns no data in the UI because the CSP rules specify connect-src http://*.mydomain.com.
In this case, add http:// to connect-src.
What's Next
If none of the previous steps resolved the issue, open a chat and provide a link to your Browser Monitor, and the troubleshooting steps you have already completed.
You can find further troubleshooting tips for Synthetic in the Synthetic Troubleshooting Map
