nginx-csps.conf

# These serve as the default for non helm deployments of this image.
# These are overriden by the configs.yaml template in charts/discovery_ui. 
# Changes here will likely need to be made there as well.
add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-eval' 'unsafe-inline' *.googletagmanager.com *.google-analytics.com; style-src 'self' 'unsafe-inline'; frame-src *.auth0.com; img-src 'self' *.amazonaws.com *.mapbox.com *.openstreetmap.org *.google-analytics.com *.google.com *.doubleclick.net data: blob:; connect-src 'self' *.auth0.com *.mapbox.com *.openstreetmap.org *.plot.ly http://localhost:*; worker-src blob:;";