# Jenkins Content Security Policy

**URL:** <https://community.jenkins.io/t/jenkins-content-security-policy/23650>\
**Category:** Using Jenkins\
**Tags:** question\
**Created:** [November 20, 2024, 9:08am UTC](https://community.jenkins.io/t/jenkins-content-security-policy/23650 "2024-11-20T09:08:07Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![jdash](https://avatars.discourse-cdn.com/v4/letter/j/a3d4f5/32.png) [@jdash](https://community.jenkins.io/u/jdash)\
**Post date:** [November 20, 2024, 9:08am UTC](https://community.jenkins.io/t/jenkins-content-security-policy/23650/1 "2024-11-20T09:08:07Z")

</div>

Hello Team,

I want to pass this CSP only to my agents and fetch the reports.html but its not working. Do I need to pass in Jenkins controller ?

If I need to pass this in agent , In the agent configuration I am passing it as environment variable and its not working

```auto
System.setProperty("hudson.model.DirectoryBrowserSupport.CSP", 
                   "sandbox; default-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline';");

```

---

<div class="post-metadata">

**Author:** ![mawinter69](https://dub1.discourse-cdn.com/flex013/user_avatar/community.jenkins.io/mawinter69/32/1625_2.png) [@mawinter69](https://community.jenkins.io/u/mawinter69)\
**Post date:** [November 20, 2024, 10:15am UTC](https://community.jenkins.io/t/jenkins-content-security-policy/23650/2 "2024-11-20T10:15:51Z")

</div>

It doesn’t make sense to set this on agents as they do not deliver html pages. Those pages are delivered by the controller so you need to set it there.