---
whitelist:
script-src-elem:
- "{{ lookup('asset_host') }}"
style-src-elem:
- "{{ lookup('asset_host') }}"
font-src:
- "{{ lookup('asset_host') }}"
- "data:"
connect-src:
- "{{ lookup('asset_host') }}"
frame-src:
- "{{ lookup('tls', 'web-app-littlejs', 'url.base') }}"
flags:
style-src-attr:
unsafe-inline: true # nocheck: csp-unsafe Reason: historical, TODO: re-verify it is really required and does not open attack surface
script-src-elem:
unsafe-inline: true # nocheck: csp-unsafe Reason: historical, TODO: re-verify it is really required and does not open attack surface
unsafe-eval: true # nocheck: csp-unsafe Reason: historical, TODO: re-verify it is really required and does not open attack surface
script-src-attr:
unsafe-inline: true # nocheck: csp-unsafe Reason: historical, TODO: re-verify it is really required and does not open attack surface
unsafe-eval: true # nocheck: csp-unsafe Reason: historical, TODO: re-verify it is really required and does not open attack surface
