Security Headers

Configure supported browser security headers for your LoginRadius authentication and profile pages from the Admin Console. These settings help reduce clickjacking, MIME type sniffing, cross-site scripting, and unintended referrer data sharing risks.

Open security headers

Open the Security Headers tab from Tenant Settings to manage the headers for your tenant.

Log in to the LoginRadius Admin Console.
Navigate to Tenant Settings.
Select the Security Headers tab.
Configure the required header options.
Click Save.

The tab is available for supported LoginRadius tenants.

Configure headers

Use the following controls to configure the response headers applied to supported pages.

Admin Console option	Header	Description
X Frame Options	`X-Frame-Options`	Controls whether pages can load inside a frame or iframe on another website.
X Content Type Options	`X-Content-Type-Options`	Instructs browsers to follow the declared content type instead of guessing the file type.
Referrer Policy	`Referrer-Policy`	Controls how much referrer information the browser shares.
Content Security Policy	`Content-Security-Policy`	Restricts the sources from which page resources can load.

The Security Headers tab includes these controls:

Block iframe embedding: Adds the X-Frame-Options response header to help prevent clickjacking.
Block MIME type sniffing: Adds X-Content-Type-Options: nosniff so browsers do not interpret a response as a different content type.
Header value: Sets the value for the Referrer-Policy header.
Policy value: Sets the directives for the Content-Security-Policy header.

Configure Content Security Policy

Content Security Policy (CSP) limits the sources that can provide resources to a page. Use the Policy value field to add directives that match the trusted resources required by your implementation.

Common directives include:

script-src: Controls the sources that can load JavaScript.
style-src: Controls the sources that can load stylesheets and inline styles.
img-src: Controls the sources that can load images.
font-src: Controls the sources that can load fonts.
connect-src: Controls the endpoints that the page can contact, such as APIs.
frame-src: Controls the sources that can load in frames.

Prevent clickjacking

Clickjacking protection helps prevent pages from being displayed inside another website's frame or iframe. Enable Block iframe embedding unless your implementation requires pages to be framed.

Prevent MIME type sniffing

The X-Content-Type-Options header helps prevent MIME type sniffing. Enable Block MIME type sniffing to apply X-Content-Type-Options: nosniff.

Choose referrer policy

The Referrer-Policy header controls the referrer information that the browser sends when a user navigates from a page or when a page loads an external resource.

Use Header value to select a policy that matches your privacy and integration requirements.

Policy	Behavior
`no-referrer`	Does not send referrer information.
`origin`	Sends only the origin, such as scheme, host, and port.
`strict-origin-when-cross-origin`	Sends the full referrer for same-origin requests and only the origin for secure cross-origin requests.
`unsafe-url`	Sends the full URL as the referrer. Use only when required by your implementation.

Apply a CSP safely

Review the resources used by your authentication and profile pages before applying a strict CSP. Use a controlled rollout to confirm that required resources are allowed.

Identify the trusted domains required for scripts, styles, images, fonts, API calls, and frames.
Apply the most restrictive policy that allows those resources to load.
Test the policy in a non-production environment or during a controlled rollout.
Review browser console messages and network requests for blocked resources.
Update the policy as needed, then save the final configuration.

Troubleshoot CSP violations

A browser usually reports a CSP violation in the developer console and identifies the blocked directive and resource URL. Use the message and the network panel to determine whether the blocked resource is required and trusted.

Issue	Possible cause	Recommended action
Scripts do not load or page actions stop working	The required script source is missing from `script-src`, or an inline script is restricted.	Add only the required trusted script domains to `script-src`. Replace inline scripts with external scripts where possible.
Styles or layout appear broken	A required stylesheet or font source is missing from `style-src` or `font-src`.	Allow the trusted domains that serve the required CSS and fonts.
Images, logos, or icons are missing	The image host is not allowed by `img-src`.	Add the required trusted image source to `img-src`.
API calls or integrations fail	The destination is not allowed by `connect-src`.	Add the required API or integration origin to `connect-src`. Confirm the protocol, domain, and subdomain.
Frames or embedded content do not appear	The frame source is blocked by `frame-src`, or iframe embedding is disabled.	Add the trusted frame source only when the embedded content is required. Review clickjacking protection if the implementation depends on framing.

Investigate a violation

Open the affected page in a supported browser.
Open the browser developer tools.
Review the console for CSP violation messages.
Identify the directive mentioned in the message, such as script-src, style-src, connect-src, or frame-src.
Confirm whether the blocked resource is required and trusted.
Update the policy to allow only the required trusted source.
Test the updated policy before applying it to production.

Best practices

Use trusted sources: Add only the domains required by your implementation to CSP directives.
Keep policies narrow: Avoid broad source values unless your implementation requires them.
Review integrations: Recheck the policy after changing branding, page customization, or third-party integrations.
Limit referrer data: Choose a Referrer Policy that avoids sharing unnecessary URL information.
Protect pages by default: Enable clickjacking and MIME type sniffing protection unless your implementation requires otherwise.
Test before production: Validate strict CSP changes in a lower environment or controlled rollout to prevent disruption to login and profile experiences.