Merge pull request #1001 from DFE-Digital/hotfix/app-insights-sdk-csp

Add App Insights SDK to CSP script-src
DFE-Digital · Jan 29, 2025 · 349237a · 349237a
2 parents 1b6bfdb + 6314050
commit 349237a
Showing 1 changed file with 5 additions and 2 deletions.
diff --git a/...anageFreeSchoolProjects/Dfe.ManageFreeSchoolProjects/Security/SecureHeadersDefinitions.cs b/...anageFreeSchoolProjects/Dfe.ManageFreeSchoolProjects/Security/SecureHeadersDefinitions.cs
@@ -6,6 +6,7 @@ public static class SecurityHeadersDefinitions
 	{
 		static string GoogleTagManagerUri => "https://www.googletagmanager.com";
 		static string GoogleAnalyticsUri => "https://www.google-analytics.com/";
+		static string ApplicationInsightsUri => "https://js.monitor.azure.com/";
 
 		public static HeaderPolicyCollection GetHeaderPolicyCollection(bool isDev)
 		{
@@ -39,8 +40,10 @@ public static HeaderPolicyCollection GetHeaderPolicyCollection(bool isDev)
 					builder.AddFontSrc().Self();
 					builder.AddStyleSrc().Self();
 					builder.AddBaseUri().Self();
-					builder.AddScriptSrc().From(GoogleTagManagerUri).UnsafeInline().WithNonce();
-               builder.AddFrameAncestors().None();
+					builder.AddScriptSrc()
+						.From(GoogleTagManagerUri).From(ApplicationInsightsUri)
+							.UnsafeInline().WithNonce();
+					builder.AddFrameAncestors().None();
 				})
 				.RemoveServerHeader()
 				.AddPermissionsPolicy(builder =>