Add GOVUK domains to script src CSP

The assets domain can't POST to the feedback form without this.
alphagov · Dec 20, 2023 · b30410c · b30410c
1 parent 6639ba2
commit b30410c
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/lib/govuk_app_config/govuk_content_security_policy.rb b/lib/govuk_app_config/govuk_content_security_policy.rb
@@ -51,6 +51,7 @@ def self.build_policy(policy)
     policy.script_src :self,
                       *GOOGLE_ANALYTICS_DOMAINS,
                       *GOOGLE_STATIC_DOMAINS,
+                      *GOVUK_DOMAINS,
                       # Allow YouTube Embeds (Govspeak turns YouTube links into embeds)
                       "*.ytimg.com",
                       "www.youtube.com",