vendredi 4 juin 2021

Is it safe to add a localhost URL to allowlist of CSP for local development?

I am working in a React app created with create-react-app.

We have a Content Security Policy set up in the meta tag in public/index.html.

I'm required to add a connect-src directive for a 3rd party widget we're adding to our site, but when I add the connect-src directive, my backend which is running on localhost:8000 during development is blocked.

Is it suitable to add localhost:8000 in the connect-src directive or is there a better way to whitelist this URL during development?

Aucun commentaire:

Enregistrer un commentaire