---
flags:
script-src-elem:
unsafe-inline: true # nocheck: csp-unsafe Reason: historical, TODO: re-verify it is really required and does not open attack surface
unsafe-eval: true # nocheck: csp-unsafe Reason: historical, TODO: re-verify it is really required and does not open attack surface
script-src-attr:
unsafe-eval: true # nocheck: csp-unsafe Reason: historical, TODO: re-verify it is really required and does not open attack surface
style-src-elem:
unsafe-inline: true # nocheck: csp-unsafe Reason: historical, TODO: re-verify it is really required and does not open attack surface
style-src-attr:
unsafe-inline: true # nocheck: csp-unsafe Reason: historical, TODO: re-verify it is really required and does not open attack surface
whitelist:
connect-src:
- "{{ lookup('domain', 'web-app-odoo') }}"
- "wss://{{ lookup('domain', 'web-app-odoo') }}"
frame-ancestors:
- "{{ DOMAIN_PRIMARY }}"
- "*.{{ DOMAIN_PRIMARY }}"
font-src:
- "data:"
- https://fonts.gstatic.com # nocheck: external-cdn,url TODO: migrate to lookup('asset') or confirm the upstream app loads this CDN itself
style-src-elem:
- https://fonts.googleapis.com # nocheck: external-cdn,url TODO: migrate to lookup('asset') or confirm the upstream app loads this CDN itself
