PH53192: THE /API/EXPLORER URL FROM OPENAPI-3.0 DOES NOT RETURN CONTENT-SECURITY-POLICY HEADER

APAR status

• Closed as program error.

Error description

• When requests are sent to /api/explorer, the response does not
  return the Content-Security-Policy header.  The URL
  /api/explorer is part of the openapi-3.0 feature.
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:  All users of IBM WebSphere Application      *
  *                  Server                                      *
  *                  Liberty Core                                *
  ****************************************************************
  * PROBLEM DESCRIPTION: Add Content-Security-Policy to          *
  *                      MicroProfile OpenAPI and API Discovery  *
  *                      UI                                      *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  Add CSP header to limit source locations from where MicroProfile
  OpenAPI and API Discovery UI can fetch the displayed content
  

Problem conclusion

• The fix for this APAR is targeted for inclusion in fix pack
  23.0.0.6. For more information, see 'Recommended Updates for
  WebSphere Application Server':
  https://www.ibm.com/support/pages/node/715553
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  WAS LIBERTY COR

• Fixed component ID

  5725L2900

Applicable component levels