Advanced Settings in Power Pages Security Workspace
Advanced Settings in Power Pages Security Workspace
The Advanced Settings section in the Power Pages Security Workspace provides administrators with granular control over website security. These settings help protect applications from common web vulnerabilities such as Cross-Site Scripting (XSS), Cross-Site Request Forgery (CSRF), data injection attacks, clickjacking, unauthorized resource access, and insecure communication.
By configuring Content Security Policy (CSP), Cross-Origin Resource Sharing (CORS), Cookies, HTTP Security Headers, HTTPS enforcement, and Referrer Policies, organizations can significantly strengthen the security posture of their Power Pages websites.
Access Advanced Settings
- Open Power Pages Design Studio.
- Navigate to the Security Workspace.
- Select Advanced Settings.
- Configure the required security policies.
- Save and publish changes.
Content Security Policy (CSP)
Content Security Policy (CSP) is a browser security mechanism that restricts which resources can be loaded and executed by a webpage. CSP helps prevent Cross-Site Scripting (XSS), malicious code injection, and data exfiltration attacks.
Supported CSP Directives
| Directive | Purpose |
|---|---|
| Default Source | Fallback policy for all resources not covered by specific directives. |
| Image Source | Controls allowed image domains. |
| Font Source | Controls allowed font providers. |
| Script Source | Defines trusted JavaScript sources. |
| Style Source | Defines trusted CSS stylesheets. |
| Connect Source | Controls API calls, WebSockets, and AJAX requests. |
| Media Source | Controls audio and video sources. |
| Frame Source | Controls embedded frames and iframes. |
| Frame Ancestors | Prevents clickjacking by controlling who can embed your site. |
| Form Action | Controls where forms can submit data. |
| Worker Source | Controls web worker execution. |
| Manifest Source | Controls application manifests and worker scripts. |
Benefits of CSP
- Prevents Cross-Site Scripting (XSS).
- Blocks unauthorized scripts.
- Protects sensitive information.
- Reduces malicious code execution.
- Improves browser security.
Cross-Origin Resource Sharing (CORS)
CORS controls how resources are shared between different domains. It determines which external applications can access APIs and resources hosted by your Power Pages website.
| Directive | Description |
|---|---|
| Allow Accessing Resources | Defines trusted domains. |
| Send Headers | Defines allowed request headers. |
| Expose Headers | Defines response headers accessible to client applications. |
| Define Methods | Specifies allowed HTTP methods such as GET, POST, PUT, DELETE. |
| Cache Request Results | Controls preflight request caching duration. |
| Share Credentials | Allows authentication cookies and tokens. |
| Display in Iframe | Controls iframe embedding permissions. |
| Block MIME Sniffing | Prevents browsers from guessing content types. |
Cookie Security Configuration
Cookie policies help prevent CSRF attacks and protect sensitive session data.
Cookie Transfer Rules
| Setting | Purpose |
|---|---|
| SameSite Default | Applies security rules to all cookies. |
| SameSite Specific Cookie | Applies rules to selected cookies only. |
Using SameSite settings helps prevent unauthorized cross-site requests and protects user sessions.
HTTPS Enforcement
The Strict-Transport-Security (HSTS) header forces browsers to use HTTPS connections and prevents insecure HTTP communication.
- Enforces encrypted communication.
- Prevents protocol downgrade attacks.
- Protects authentication cookies.
- Improves website trust and compliance.
Referrer Policy
The Referrer-Policy header controls how much referral information browsers send when users navigate between websites.
Organizations can use Referrer Policy settings to balance security, privacy, and analytics requirements.
Security Best Practices
- Always enable HTTPS.
- Use strict CSP rules.
- Allow only trusted domains in CORS.
- Enable SameSite cookie protection.
- Block MIME sniffing.
- Review security headers regularly.
- Perform routine security audits.
- Monitor browser security reports.
Summary
Advanced Settings in Power Pages provide powerful controls for securing websites through CSP, CORS, cookies, HTTPS enforcement, and HTTP security headers. Proper configuration of these settings helps organizations defend against modern web threats, strengthen compliance, and provide a secure experience for users.