Feature impacts when a CSP blocks unsafe directives

If your Content Security Policy (CSP) does not include the directives script-src 'unsafe-eval' ; and script-src 'unsafe-inline' ;, some Cognos Analytics features do not work. These two directives control certain HTML processes that were used in legacy features that are still included in Cognos Analytics.

When unsafe directives are blocked by a CSP, the affected Cognos Analytics features can be classified in two ways:

Features that are disabled by the administrator

The following sections comprise the predefined set of Cognos Analytics features that are unavailable because the Cognos Analytics administrator disabled them.

Administration console

The Administration console is unavailable. For more information, see Administration and Security.

Note: If you must use the legacy Administration console, you can temporarily bypass the gateway that hosts the CSP and connect directly to the Dispatcher URL. For example, enter the following URL: https://cognos_server_name:9300/bi/v1/disp?b_action=cogadmin

Only during the period that you use the Administration console, ensure that you do not disable the features that are being blocked by the CSP.

Browser-side caching in dashboards

Browser-side caching in dashboards is unavailable. For more information, see Specifying data elements for browser-side caching.

IBM Cognos Viewer (classic viewer)

IBM Cognos Viewer is unavailable. For more information, see Limited and fully interactive reports.

Portal pages

Portal pages are unavailable. For more information, see Enable My portal pages.

Rave1 visualizations

Rave1 visualizations are unavailable. For more information, see Visualizations version 11.x,

Cognos Analytics Mobile Reports (legacy app)

Cognos Analytics Mobile Reports is unavailable. For more information, see Cognos Analytics Mobile Reports administration.

PowerPlay

PowerPlay is unavailable. For more information, see Getting started with PowerPlay Client.

Cube Designer

Cube Designer is unavailable. For more information, see Getting started with Cognos Cube Designer.

Dynamic Query Analyzer

Dynamic Query Analyzer is unavailable. For more information, see Dynamic Query Analyzer.

Event agent (formerly Event Studio)

Event agent is unavailable. For more information, see IBM Cognos Event agent.

My inbox and My watch items

The My inbox and My Watch items are not available from the Personal menu. For more information, see Functionality mapping from Cognos BI to Cognos Analytics

My Subscriptions

My Subscriptions is not available. For more information, see Functionality mapping from Cognos BI to Cognos Analytics.

Additional feature limitations

The following sections list the limitations of additional Cognos Analytics features when unsafe directives are blocked by a CSP. A resolution is provided for each limitation.

Framework Manager

Framework Manager is not supported if Webview2 is enabled. If you enable Webview2, Framework Manager users will encounter the following issues:

  • They cannot select a publish location from the Publish wizard.
  • They cannot create a new data source from the Metadata wizard.
  • They cannot navigate to select users and groups when they want to specify object, data, and package security.
Resolution

Disable Webview2 for Framework Manager.

Transformer

Transformer is not supported if Webview2 is enabled. If you enable Webview2, Transformer users will encounter the following issues:

  • They cannot select a publish location from Publish wizard.
  • They cannot create a new data source from the Metadata wizard.
  • They cannot navigate between users and groups when they want to specify object, data, and package security.
Resolution

Disable Webview2 for Transformer.

Customer-authored content

Some Cognos Analytics features allow you to author your own content. For example, you can add links to external sites or create custom HTML markup. If any of this customer-authored content violates your own company's CSP, it is blocked by the web browser. This can result in broken links or custom controls that don't work.

Resolution

Change your authored content to stop violating your CSP or add the associated directives to your CSP to allow the operations.

Reporting

Custom visualizations cannot be added to a report.

Resolution

Add the directive script-src 'self' d3js.org ; to the CSP.

Notebook

Notebook Editor does not work.

Resolution

Add the directive script-src 'self' d3js.org ; to the CSP.