Configuring QMS client content security policy (Optional)

It may be desirable to run the QMS client web application with different content security policy (CSP) than is setup by default. The default CSP configured when QMS is initially installed is:

  • default-src 'self'; connect-src 'self' http://*:8031 http://*:8038; media-src 'self' http://*:4533 http://*:8038; img-src 'self' data: http://*:8038; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; style-src-elem 'self' 'unsafe-inline' http://*:8031; font-src 'self' http://*:8031; worker-src 'self' blob:; frame-src blob:; frame-ancestors 'none'

The http: parameters will be modified by the QMS config security tool to https if the QMS Client is secured. To modify the default CSP take the following steps:

  1. Open the appSettings.json file for editing (found in the QMS Client IIS directory, which is normally C:\Inetpub\wwwroot\QMS\appSettings.json).

  2. Find the "AppSettings" node and change the ContentSecurityPolicy attribute to the desired CSP.

Please keep in mind that a few default items are required for the QMS client to correctly function: script-src must allow 'unsafe-inline' and 'unsafe-eval', style-src must allow 'unsafe-inline', and style-src-elem must allow 'unsafe-inline'

The default CSP uses wildcards to represent urls to reach specific QMS services for client features. If your security needs require no wildcards you can update the urls to contain specific hostnames for your environment. Below is a description of each url:

  1. connect-src - http://*:8031 http://*8038 - this represents the reporting service and the recording playback hosted by the QMS DataService. To remove the wildcard you would need to replace it with the possible hostnames that browsers will use to reach the reporting service. For example, if your DataService is on a machine with a FQDN qms-dataservice1.enghouse.com but you also want to allow connections from browsers located on the DataService server itself using localhost. You would modify the connect-src to be:

    connect-src 'self' http://localhost:8031 http://qms-dataservice1.enghouse.com:8031 http://localhost:8038 http://qms-dataservice1.enghouse.com:8038;

  2. style-src-elem - http://*:8031 - this represents the report viewer stylesheet that the QMS client retrieves from the reporting service hosted by the QMS DataService. To remove the wildcard you would need to replace it with the possible hostnames that browsers will use to reach the reporting service. For example, if your DataService is on a machine with a FQDN qms-dataservice1.enghouse.com but you also want to allow connections from browsers located on the DataService server itself using localhost. You would modify the style-src-elem to be:

    style-src-elem 'self' 'unsafe-inline' http://localhost:8031 http://qms-dataservice1.enghouse.com:8031;

  3. font-src - http://*:8031 - this represents the report viewer fonts that the QMS client retrieves from the reporting service hosted by the QMS DataService. To remove the wildcard you would need to replace it with the possible hostnames that browsers will use to reach the reporting service. For example, if your DataService is on a machine with a FQDN qms-dataservice1.enghouse.com but you also want to allow connections from browsers located on the DataService server itself using localhost. You would modify the font-src to be:

    font-src 'self' http://localhost:8031 http://qms-dataservice1.enghouse.com:8031;

  4. media-src - http://*:4533 - this represents the live monitor service hosted by the QMS CallRecordingService. To remove the wildcard you would need to replace it with the possible hostnames that browsers will use to reach each CallRecordingService in your deployment. For example, if you have 2 CallRecordingServices on a machines with a FQDNs qms-recordingservice1.enghouse.com and qms-recordingservice2.enghouse.com. You would modify the media-src to be:

    media-src 'self' http://qms-recordingservice1.enghouse.com:4533 http://qms-recoridngservice2.enghouse.com:4533 http://*:8038;

  5. media-src - http://*:8038 - this represents the recording playback host hosted by the QMS DataService that provided media files. To remove the wildcard you would need to replace it with the possible hostnames that browsers will use to reach the playback host. For example, if your DataService is on a machine with a FQDN qms-dataservice1.enghouse.com but you also want to allow connections from browsers located on the DataService server itself using localhost. You would modify the connect-src to be:

    media-src 'self' http://*:4533 http://localhost:8038 http://qms-dataservice1.enghouse.com:8038;

  6. img-src - http://*:8038 - this represents the recording playback host hosted by the QMS DataService. To remove the wildcard you would need to replace it with the possible hostnames that browsers will use to reach the playback host. For example, if your DataService is on a machine with a FQDN qms-dataservice1.enghouse.com but you also want to allow connections from browsers located on the DataService server itself using localhost. You would modify the connect-src to be:

    img-src 'self' http://localhost:8038 http://qms-dataservice1.enghouse.com:8038;

It is recommended when configuring the QMS client for SSL that you also configure each CallRecordingService to secure live monitor streams. If, for some reason, you are not following this convention and are securing the QMS client but electing to not secure the live monitor streams, you will need to manually edit the CSP after saving the secured client configuration in QMSConfig to change the https://*:4533 entry to use http:// instead.