Edit

Share via

Security issues (preview)

  • Article

[This topic is prerelease documentation and is subject to change.]

In this article, you'll learn about Site Checker diagnostics results for security issues.

Important

  • This is a preview feature.
  • Preview features aren’t meant for production use and may have restricted functionality. These features are available before an official release so that customers can get early access and provide feedback.

Web Application firewall enabled

Enable Web Application Firewall to secure your site. More information: Configure Web Application Firewall for Power Pages (preview)

Anonymous access to Dataverse tables

This check fails if there are one or more table permissions that allow anonymous users to access Dataverse data. Review the table permissions and remove anonymous user access unless your use case requires anonymous access. More information: Configuring table permissions

Web template validation

Web template validation, which is enabled by default, prevents malicious scripts from running on your website. This check fails when Web template validation is disabled. You can enable Web Template Validation by removing the setting “DisableValidationWebTemplate” or setting the value to false. More information: Configure site settings for websites

HTTP headers

The following site settings are used to configure CORS and their recommended values. Review and switch the headers to recommended values unless your use case dictates otherwise.

Security check Site setting Recommended value
Access-Control-Allow-Origin restriction HTTP/Access-Control-Allow-Origin False or remove the setting
Access-Control-Allow-Credentials restriction HTTP/Access-Control-Allow-Credentials False or remove the setting
Content Security Policy HTTP/Content-Security-Policy script-src https: 'nonce'
X Frame Options configuration HTTP/X-Frame-Options SAMEORIGIN or DENY
HTTP/X-Content-Type-Options configuration HTTP/X-Content-Type-Options nosniff

See also