Setting up Content Security Policy for 1C-Bitrix

Content Security Policy Setup for 1C-Bitrix

CSP is a header that tells the browser which sources are permitted to load resources. Configuring it for Bitrix sites is non-trivial: the core, components, and third-party widgets (analytics, chat tools, payment forms) use dozens of different domains, and an incorrect CSP will either do nothing or break functionality.

How to Implement CSP in Bitrix

The header is added at the web server level or in code. The preferred approach is via nginx:

add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' https://www.google-analytics.com; img-src 'self' data: https:; style-src 'self' 'unsafe-inline';" always;

Alternatively, add it in init.php via \Bitrix\Main\Context::getCurrent()->getResponse()->addHeader(), but in that case the header will not apply to static assets.

Analyzing Required Sources

Before writing the policy — use Content-Security-Policy-Report-Only mode:

add_header Content-Security-Policy-Report-Only "default-src 'self'; report-uri /csp-report-endpoint" always;

The browser will log violations without blocking anything. Monitor the devtools console for several days, collecting all domains used by your components.

Typical sources for a Bitrix site:

• 'unsafe-inline' for script-src — nearly unavoidable due to Bitrix inline scripts
• https://mc.yandex.ru — Yandex.Metrica
• https://www.google-analytics.com, https://www.googletagmanager.com — GTM/GA
• https://pay.alfabank.ru, https://securepay.tinkoff.ru — payment systems (for frame-src)
• https://widget.jivosite.com — Jivo and similar (for frame-src, connect-src)

Limitations Due to Inline Code

Bitrix makes extensive use of onclick attributes and inline <script> tags without nonces — this conflicts with script-src 'self' without 'unsafe-inline'. Fully removing 'unsafe-inline' requires refactoring templates and components to add nonce attributes.

A pragmatic compromise: apply a strict CSP at least to frame-src, object-src, and base-uri — these directives provide the most security benefit with the fewest conflicts:

Content-Security-Policy: frame-ancestors 'self'; object-src 'none'; base-uri 'self';

Real-World Case

A B2C store with an embedded live chat and a payment form in an iframe. After enabling CSP, the Tinkoff payment form stopped opening — the iframe was being blocked by frame-src 'self'. The payment domain securepay.tinkoff.ru had not been added to the policy. Additionally: Yandex.Metrica stopped recording session replays (WebSocket connections to mc.yandex.ru were blocked). Solution: added all required domains to the corresponding directives using Report-Only mode, then applied the strict policy.

Delivery Time

Developing and deploying CSP with a preliminary Report-Only audit — 4 to 8 hours depending on the number of third-party services on the site.