Why does CSP block my own source even though I set it so self?

Viewed 11

I'm currenty learning and setting up CSP and I'm not sure what the problem is here. I have set my CSP like this (Caddy):

(content_policy) {
    header {
        # For older browser, newer ones use frame ancestors
        # SAMEORIGIN = self, DENY = none
        X-Frame-Options DENY
        Content-Security-Policy "
            default-src 'self';
            style-src 'self';
            script-src 'self';
            font-src 'self';
            img-src 'self';
            form-action 'self';
            connect-src 'self';
            frame-ancestors 'none';
            object-src 'none';"
    }
}

But two sources from a selhosted AdGuard instance are blocked even though they are from "self":

enter image description here

Does someone know why or what I did wrong here?

0 Answers
Related