Content Security Policy (CSP) for Code Apps

[scottdurow]

I can see a need for being able to control your app HTTP headers such as CSP (Content Security Policy) like Power Pages - https://learn.microsoft.com/en-us/power-pages/security/manage-content-security-policy

Thoughts?

[rnwood]

This could maybe be modelled as a special "connector" in the DLP policies. Then a list of the allowed domains there could control the hosts appearing in the CSP headers. This would ensure that these apps aren't operating outside of DLP and there's no new concept needed to allow this to be configured.

[jordanchodakWork]

@scottdurow, @rnwood

Check the announcement I just posted to learn about and take action on configuring CSP enforcement for code apps!