---
whitelist:
script-src-elem:
- "{{ lookup('asset_host') }}"
- https://kit.fontawesome.com # nocheck: external-cdn,url TODO: migrate to lookup('asset') or confirm the upstream app loads this CDN itself
- https://code.jquery.com/ # nocheck: external-cdn,url TODO: migrate to lookup('asset') or confirm the upstream app loads this CDN itself
style-src-elem:
- https://kit.fontawesome.com # nocheck: external-cdn,url TODO: migrate to lookup('asset') or confirm the upstream app loads this CDN itself
- https://code.jquery.com/ # nocheck: external-cdn,url TODO: migrate to lookup('asset') or confirm the upstream app loads this CDN itself
font-src:
- https://ka-f.fontawesome.com # nocheck: external-cdn,url TODO: migrate to lookup('asset') or confirm the upstream app loads this CDN itself
img-src:
- "{{ lookup('config', 'web-svc-asset', 'services.asset.url') }}"
connect-src:
- https://ka-f.fontawesome.com # nocheck: external-cdn,url TODO: migrate to lookup('asset') or confirm the upstream app loads this CDN itself
- "{{ lookup('domain', 'web-app-keycloak') }}"
frame-src:
- "*.{{ DOMAIN_PRIMARY }}"
- "{{ lookup('domain', 'web-app-keycloak') }}"
flags:
script-src:
unsafe-inline: false
script-src-elem:
unsafe-inline: false
script-src-attr:
unsafe-inline: true # nocheck: csp-unsafe Reason: port-ui 2.2.2 renders inline event handlers (menu onclick entries, openDynamicPopup, closeAllModals, card image onerror)
