CSP default-src not used as fallback

Hi Steven Van Loon,

'default-src' is used and overridden by the other options if needed be.

What are you trying to accomplish here? Embeeding an IFrame in a dashlet? Using dashlet web?

What is the exact error you are getting?

Hi Rafael,

We have a custom package that allows the end user to open the url of our application on a record. When the url is only in default-src with connect-src empty, this error occurs

Content Security Policy: The page’s settings blocked the loading of a resource at [url of our app] (“connect-src”).

if the url of our app is added to connect-src also, it works without errors.

Gr, Steven.

Hi Steven,

As per CSP's specification, the user agent should fallback to default-src.

I've seen (with google maps even) that they first give you a 302 response and redirect to a different URL, that URL must also be present in the default-src.

Something is going on along those lines, it is not related to the fallback.

If you are confident that this is not the case, please open a support ticket with all the details you have and if possible, a reproducible scenario so we can investigate.

Hi Steven,

As per CSP's specification, the user agent should fallback to default-src.

I've seen (with google maps even) that they first give you a 302 response and redirect to a different URL, that URL must also be present in the default-src.

Something is going on along those lines, it is not related to the fallback.

If you are confident that this is not the case, please open a support ticket with all the details you have and if possible, a reproducible scenario so we can investigate.