Merge pull request #130 from alphagov/updating-CSP-for-new-HMRC-Webch…

…at-provider Added script-src for Nuance/HMRC Webchat provider
alphagov · Jan 22, 2020 · b98f4e5 · b98f4e5
2 parents 6ddde9a + 16ed131
commit b98f4e5
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/lib/govuk_app_config/govuk_content_security_policy.rb b/lib/govuk_app_config/govuk_content_security_policy.rb
@@ -41,6 +41,8 @@ def self.build_policy(policy)
                       "*.ytimg.com",
                       "www.youtube.com",
                       "www.youtube-nocookie.com",
+                      # Allow JSONP call to Nuance - HMRC web chat provider
+                      "hmrc-uk.digital.nuance.com",
                       # Allow all inline scripts until we can conclusively
                       # document all the inline scripts we use,
                       # and there's a better way to filter out junk reports