The problem we are facing when adding HubSpot scripts and functionality to our web product is that they are loaded from various domains and sub-domains. I have a CSP in place for security reasons, so all scripts, iframe, form, image sources, etc., need to be put on the allowlist before they’re loaded.
I’m sure there’s a good reason why the scripts come from so many different domains, but every time we put one domain on the allowlist, it shows another domain on the network window while inspecting. Can I get a list of all possible domains/subdomains needed to allowlist to resolve the CSP error and track all the functionalities of the Hubspot script, or could someone tell me a workaround? As of right now, the process of allowlisting is full of friction.
I am facing a similar issue myself with the CSP header. My question is: how can we update the CSP header in the Domain security settings? Whenever I add the code to the CSP, my site throws errors and breaks. I want to narrow down the CSP to avoid broad issues in my domain. To achieve this, I need to add ‘object-src’ and ‘script-src’ directives to ‘self’, limiting the handling of objects and scripts to only those on my own domain, or specifying trusted domains.
I’ve read and understood an article about setting up the CSP header, but it’s too confusing for me to implement on my domain. Could you please guide me through this issue? Your help would be greatly appreciated.
Welcome to the community. Hey,