Securing the Web Application Content

Nectari can be embedded into other websites. This is required for some Sage products such as Sage 300, which integrates Nectari within its own websites.

However, this enables the possibility of a hostile entity to embed Nectari into a malicious site and allows for clickjacking.

To prevent this, you can add a Content Security Policy called frame-ancestors that will allow only the specified websites to embed Nectari.

There are two ways to add the Content Security Policy.

To add the Content Security Policy using the web.config file:

1. Open the web.config file.

2. Locate the customHeaders tag.

3. Add this line:

   <add name="Content-Security-Policy" value="frame-ancestors http://website1.url.com https://website2.url.com />

   Examples of websites URLs:

   http://example.nectari.com

   https://*.nectari.com

   For further examples, refer to CSP: frame-ancestors.

   

4. Save the file.

To add the Content Security Policy using IIS:

1. Open IIS Manager:

   1. Press the Windows key + R to open the Run window.

   2. Type inetmgr and press the Enter key.

2. Under the IIS section, open HTTP Response Headers.

3. In the Actions panel on the right, click Add.

   

4. In the Name field, enter Content-Security-Policy.

5. In the Value field, enter the website URL.

6. Click OK.

   

7. Repeat steps 3 to 6 for each website you wish to add.