Fix Content Security Policy for Outlook

wandyezj · Jun 22, 2024 · acc217f · acc217f
1 parent 409db83
commit acc217f
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 1 deletion.
diff --git a/docs/features/content-security-policy.md b/docs/features/content-security-policy.md
@@ -0,0 +1,6 @@
+# Content Security Policy
+
+The policy applied
+
+- script-src `ajax.aspnetcdn.com`
+    - required for outlook, loaded by office.js
diff --git a/src/edit.html b/src/edit.html
@@ -4,7 +4,7 @@
         <meta charset="UTF-8" />
         <meta
             http-equiv="Content-Security-Policy"
-            content="default-src 'self'; script-src 'self' appsforoffice.microsoft.com; style-src 'self' 'unsafe-inline'; connect-src *; frame-src telemetryservice.firstpartyapps.oaspapps.com;"
+            content="default-src 'self'; script-src 'self' appsforoffice.microsoft.com ajax.aspnetcdn.com; style-src 'self' 'unsafe-inline'; connect-src *; frame-src telemetryservice.firstpartyapps.oaspapps.com;"
         />
         <script src="https://appsforoffice.microsoft.com/lib/1/hosted/office.js" type="text/javascript"></script>
         <link rel="stylesheet" type="text/css" href="./edit.css" />