CSP default-src not used as fallback

Hi Steven Van Loon,

'default-src' is used and overridden by the other options if needed be.

What are you trying to accomplish here? Embeeding an IFrame in a dashlet? Using dashlet web?

What is the exact error you are getting?

Rafael Fernandes

We are trying to access the Google Maps API it's no longer working in Sugar 12 with the advanced options of CSP being blank.

Jeff Bickart,

What you're saying is, if you add Google Maps API URL in 'default-src' prevents it to work and when you add it to 'connect-src' it works?

If that's the case, I'd open a support ticket because this is not how it's supposed to work.

Hi Rafael,

We have a custom package that allows the end user to open the url of our application on a record. When the url is only in default-src with connect-src empty, this error occurs

Content Security Policy: The page’s settings blocked the loading of a resource at [url of our app] (“connect-src”).

if the url of our app is added to connect-src also, it works without errors.

Gr, Steven.

Hi Steven,

As per CSP's specification, the user agent should fallback to default-src.

I've seen (with google maps even) that they first give you a 302 response and redirect to a different URL, that URL must also be present in the default-src.

Something is going on along those lines, it is not related to the fallback.

If you are confident that this is not the case, please open a support ticket with all the details you have and if possible, a reproducible scenario so we can investigate.