-
Type: Bug
-
Status: Open
-
Priority: Minor
-
Resolution: Unresolved
-
Affects Version/s: 10.6.11
-
Fix Version/s: None
-
Component/s: ARender
-
Tags:
-
Backlog priority:700
When a stricter CSP is used, the Annotations tab does not load.
See errors like the following
Refused to run the JavaScript URL because it violates the following Content Security Policy directive: "script-src ... Either the 'unsafe-inline' keyword, a hash ('sha256-...'), or a nonce ('nonce-...') is required to enable inline execution.
in the browser console
Example CSP
Content-Security-Policy "img-src data: blob: persistent-bucket-here app-vip-name-here; default-src blob: persistent-bucket-here *.company.com; script-src data: app-vip-here; style-src 'unsafe-inline' *.company.com; font-src data: *; connect-src persistent-bucket-here transient-bucket-here *.company.com; media-src persistent-bucket-here *.company.com";