AG Studio allows you to work with security tools and parameters to make your application meet your business requirements.
Content Security Policy (CSP) Copy Link
The basic information on Content Security Policy can be found on the MDN Web Documentation website and will cover the necessary information on the subject. Studio works with CSP, but some basic configuration is necessary to have your application load correctly. The minimum set of CSP rules for Studio is described below.
style-src Copy Link
Themes work by injecting CSS styles into the DOM when Studio initialises. By default this requires a style-src 'unsafe-inline' directive in your CSP.
However, you can avoid this requirement using the styleNonce Studio property as shown below. The styleNonce property should be set to a random value that changes with each page load.
<ag-studio
[styleNonce]="styleNonce"
/* other studio properties ... */ />
this.styleNonce = "416d1177";This sets the nonce attribute on the style tag, so Studio will now work with the CSP directive style-src 'nonce-416d1177' without the need for 'unsafe-inline'.
CSP nonces are global to a page, so when a page has multiple Studio instances, all instances must have the same styleNonce set.
img-src Copy Link
The img-src data: directive is required because Studio uses data urls to embed SVG images in CSS files.
font-src Copy Link
If you use the loadThemeGoogleFonts Studio property, fonts will be loaded from the Google font CDN, which requires the font-src fonts.gstatic.com directive.
Example Locked-Down CSP Copy Link
This example CSP below allows Studio to be run in a secure manner:
<meta http-equiv="Content-Security-Policy"
content="default-src 'self'; style-src 'self' 'nonce-123xyz'; img-src 'self' data:">
It assumes:
- The application loads assets from the same server (
'self') - You are not using
loadThemeGoogleFonts - The random string passed to
styleNonceon this page load is "123xyz"
Security Vulnerability Testing Copy Link
Applications may be required to pass an Application Security Test prior to being put into production. If your application is using AG Studio, you will want to make sure that AG Studio has also been tested for security vulnerabilities.
AG Studio is tested for a wide variety of security vulnerabilities using the SonarQube automatic security testing tool. SonarQube performs testing using a number of security rules, covering well-established security vulnerability standards such as CWE, SANS Top 25 and OWASP Top 10. For more details please refer to the section on Security-related Rules.
Security Contact Copy Link
At AG Grid, we take security seriously. If you believe you've discovered a vulnerability, security issue, or have any concerns related to the security of our libraries or websites, we encourage you to contact us directly.
Please email us at security@ag-grid.com with details of the issue. We appreciate responsible disclosure and will work quickly to investigate and resolve any confirmed concerns.