[JENKINS-76263] Add Content-Security-Policy header

[jenkins-infra-bot]

This issue tracks the addition of the Content-Security-Policy header to Jenkins core, so that https://plugins.jenkins.io/csp/ no longer needs to be installed.

The core implementation also needs to be extensible, so that plugins can add, e.g., img-src values.

---

Originally reported by danielbeck, imported from: Add Content-Security-Policy header

• assignee: danielbeck
• status: In Progress
• priority: Major
• component(s): core
• resolution: Unresolved
• votes: 0
• watchers: 1
• imported: 2025-11-24

Raw content of original issue

This issue tracks the addition of the Content-Security-Policy header to Jenkins core, so that https://plugins.jenkins.io/csp/ no longer needs to be installed.

The core implementation also needs to be extensible, so that plugins can add, e.g., img-src values.

[jenkins-infra-bot]

• Remote link associated with this issue:

  • PR#​11269

[jenkins-infra-bot]

[Original relates_to from Jira: JENKINS-76268]

[MarkEWaite]

Released in 2.539

[l3ender]

Is there doc on what should be done to migrate to the UI-based approach if CSP was previously configured via Java system property?

-Dhudson.model.DirectoryBrowserSupport.CSP="..."

https://www.jenkins.io/doc/book/security/configuring-content-security-policy/

[daniel-beck]

@l3ender Despite both applying the same protection mechanism in your web browser, these are independent features, so you wouldn't "migrate" from what you have to this. This distinction is also mentioned on the page you link to, in the admonition block (the one with the big red "!") just after the introduction. You can find the documentation for what's new in 2.539+ here: https://www.jenkins.io/doc/book/security/csp/

Note that you should not set hudson.model.DirectoryBrowserSupport.CSP, instead configure the Resource Root URL: https://www.jenkins.io/doc/book/security/user-content/#resource-root-url
This has been the recommended way to set up Jenkins for serving user content safely since 2019, and is also strongly recommended if you want best possible protection from this new functionality.

[l3ender]

@daniel-beck Thank you for the response! We'll look into switching to root resource URL instead of our CSP configuration.