CSP settings for DevUI and Swagger

[Stwissel]

I'm locking down an application with a route filter that sets a restrictive Content-Security-Policy (CSP) of default-src: self.

As a side effect both the DevUI and the SwaggerUI won't load due to CSP violations.

I wonder what settings are actually needed for DevUI and Swagger?

[quarkus-bot[bot]]

/cc @MikeEdgar (swagger-ui), @cescoffier (devui), @phillip-kruger (devui,swagger-ui)

[Stwissel]

To answer my own question....
You need this CSP:

default-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self' data:; script-src 'self' 'unsafe-eval' 'unsafe-inline' blob:; connect-src 'self' https://hcl-software.okta.com http://localhost:8090; report-uri /api/csp-violation-report

Works for both the devUI and Swagger UI.