I'm currenty learning and setting up CSP and I'm not sure what the problem is here. I have set my CSP like this (Caddy):
(content_policy) {
header {
# For older browser, newer ones use frame ancestors
# SAMEORIGIN = self, DENY = none
X-Frame-Options DENY
Content-Security-Policy "
default-src 'self';
style-src 'self';
script-src 'self';
font-src 'self';
img-src 'self';
form-action 'self';
connect-src 'self';
frame-ancestors 'none';
object-src 'none';"
}
}
But two sources from a selhosted AdGuard instance are blocked even though they are from "self":
Does someone know why or what I did wrong here?
