Raynet One Data Hub provides a Security section in the appsettings.json file that controls HTTP security response headers. This section allows administrators to configure settings such as Content Security Policy (CSP), trusted network and proxy definitions, allowed origins for cross-origin requests, and frame embedding behavior.
Security Section Overview
The Security section is configured in the appsettings.json file located in the Raynet One Data Hub installation directory (by default C:\Program Files (x86)\Raynet One Data Hub).
The following properties are available in the Security section:
Property |
Default Value |
Description |
|---|---|---|
CspEnabled |
"false" |
Enables or disables the Content-Security-Policy response header. Set to "true" to activate CSP enforcement using the value defined in CspConfigurationString. |
CspConfigurationString |
See default configuration |
The full CSP directive string sent as the Content-Security-Policy header value. |
XFrameOptionsEnabled |
"false" |
Enables the dedicated frame ancestor configuration. When set to "true", the value of AllowedFrameAncestors is evaluated and the corresponding frame-ancestors CSP directive and legacy X-Frame-Options header are added to all responses. |
AllowedFrameAncestors |
"" |
Defines which origins are permitted to embed Raynet One Data Hub in an iframe. Only evaluated when XFrameOptionsEnabled is "true". See Allowed Values for AllowedFrameAncestors for details. |
KnownNetworks |
"" |
Defines trusted network ranges for proxy forwarding. Used when Raynet One Data Hub is deployed behind a reverse proxy. |
KnownProxies |
"" |
Lists trusted proxy server IP addresses. Used when Raynet One Data Hub is deployed behind a reverse proxy. |
AllowedOrigins |
[] |
A JSON array of origins permitted to make cross-origin requests (CORS). Leave empty to disallow all cross-origin requests, or specify origins as URL strings. |
Frame Embedding Configuration
The XFrameOptionsEnabled and AllowedFrameAncestors properties control which origins are permitted to embed Raynet One Data Hub in an iframe.
Allowed Values for AllowedFrameAncestors
The AllowedFrameAncestors property accepts the following values:
Value |
Resulting X-Frame-Options |
Behavior |
|---|---|---|
Empty ("") |
Not set |
No frame embedding restrictions are applied. Iframe embedding is permitted from any origin. |
none |
DENY |
Iframe embedding is blocked entirely. Raynet One Data Hub cannot be embedded in any iframe, including by the same origin. |
self |
SAMEORIGIN |
Iframe embedding is permitted only from the same origin as the application itself. |
URL or domain |
SAMEORIGIN |
Iframe embedding is permitted from the specified URL or domain. Multiple origins can be specified by separating them with a semicolon (;). |
|
Note: Do not add apostrophes around the keywords self or none in the AllowedFrameAncestors value. The server automatically adds the required quotation marks when constructing the frame-ancestors CSP directive (for example, 'self' or 'none'). |
|
Note: When a specific domain is configured in AllowedFrameAncestors, the legacy X-Frame-Options header is set to SAMEORIGIN rather than using the ALLOW-FROM directive. Because ALLOW-FROM is obsolete and no longer supported by current browsers, SAMEORIGIN is used as the closest available value to provide a basic level of protection for older browsers. The more precise domain restriction is enforced via the CSP frame-ancestors directive, which is supported by all modern browsers. |
Configuration Examples
Allowing Embedding from Specific Domains
To allow embedding from one or more specific domains (for example, to support embedding within a UEM portal), provide the URLs separated by a semicolon:
"Security": {
"CspEnabled": "true",
"CspConfigurationString": "default-src 'self'; ...",
"XFrameOptionsEnabled": "true",
"AllowedFrameAncestors": "self; https://portal.example.com; https://uem.example.com",
"KnownNetworks": "",
"KnownProxies": "",
"AllowedOrigins": []
}
This sets frame-ancestors 'self' https://portal.example.com https://uem.example.com in the CSP header. X-Frame-Options: SAMEORIGIN is added as a legacy fallback header.
|
Note: As an alternative to using the dedicated AllowedFrameAncestors property, you can include frame-ancestors directly in the CspConfigurationString. This approach does not set the legacy X-Frame-Options header and is suitable when only modern browser support is required. Leave XFrameOptionsEnabled set to "false" when using this approach. |
Applying Configuration Changes
|
Important: Any changes to the appsettings.json file require a restart of the Raynet One Data Hub service or application to take effect. Plan configuration changes during a maintenance window to minimize disruption to users. |
See Also