Had a customer's custom portal theme get broken upgrading to the latest 14.1. With the 47.46 firmware they have modified the Default CSP Header to Enabled from Disabled. You can fix it by disabling that under NetScaler Gateway -> Global Settings -> Configure AAA Parameter. Scroll to the bottom and change Default CSP Header back to Disabled. This will be added to the release notes in the future. Along with the ssh changes.

One of my guys says the CSP header setting is what breaks WatchGuard SAML on 13.1 builds, so I suspect it's the same on 14.1 also - will find out soon enough.

What does this header do? Is it used by WAF or ?

Had a chat with a Citrix engineer lately, and they say theme customization is always breaking stuff during upgrade (both NS and SF). At some point, they will consider removing it.

Oh, also if you change this you have to invalidate the cache under optimization. Even if you don't have it enabled, because Citrix caches their stuff anyways.

We had an issue with an earlier build and it was due to caching by the provider Akamai that resulted in the pages not rendering. CDNs cache, so flushing them after a firmware update might be necessary. I would discourage removing theme customization. Many very large organizations (Top 2000) rely on it, like the customer I mentioned earlier. Example, if you do not restrict the username delivered by SAML one could conceivably SAML (factor 1) with one user and then LDAP (factor 2) with a different user. We populate the username and prevent it's modification for that reason. Drop down selection of domains. Even Company Page Branding are requirements.

@Shane Kleinert we might not run into it, but something to be aware of just in case

@Daniel Marsh yes we had issue with Watchguard Saml on the last 13.1 version and we had to disabling CSP Header.

Same behavior on 13.1-59.19, the Default CSP Header setting are changed from DISABLED to ENABLED after upgrade, broke SAML with ADFS at my customer.