Fix Content Security Policy for Outlook (#60)

wandyezj · Jun 22, 2024 · 29ef6bd · 29ef6bd
1 parent 409db83
commit 29ef6bd
Show file tree

Hide file tree

Showing 3 changed files with 8 additions and 1 deletion.
diff --git a/.vscode/cspell.json b/.vscode/cspell.json
@@ -9,6 +9,7 @@
     "words": [
         "Addin",
         "appsforoffice",
+        "aspnetcdn",
         "CODEOWNERS",
         "endregion",
         "eqeqeq",

diff --git a/docs/features/content-security-policy.md b/docs/features/content-security-policy.md
@@ -0,0 +1,6 @@
+# Content Security Policy
+
+The policy applied
+
+- script-src `ajax.aspnetcdn.com`
+    - required for outlook, loaded by office.js
diff --git a/src/edit.html b/src/edit.html
@@ -4,7 +4,7 @@
         <meta charset="UTF-8" />
         <meta
             http-equiv="Content-Security-Policy"
-            content="default-src 'self'; script-src 'self' appsforoffice.microsoft.com; style-src 'self' 'unsafe-inline'; connect-src *; frame-src telemetryservice.firstpartyapps.oaspapps.com;"
+            content="default-src 'self'; script-src 'self' appsforoffice.microsoft.com ajax.aspnetcdn.com; style-src 'self' 'unsafe-inline'; connect-src *; frame-src telemetryservice.firstpartyapps.oaspapps.com;"
         />
         <script src="https://appsforoffice.microsoft.com/lib/1/hosted/office.js" type="text/javascript"></script>
         <link rel="stylesheet" type="text/css" href="./edit.css" />