We have recently implemented Content Security Policy in one of our .NET web apps. So far, it has been working just fine and the errors reported all make sense. However, there is one connect-src error that pops up that we cannot identify:
WSS://my.website.com
The Document URI is a valid page and uses HTTPS. The Source File is blank. The site is only HTTPS and if the client tries to use HTTP, they are redirected to HTTPS. So where is this WSS protocol coming from? As far as I know, we have no code that uses this protocol. Is there something in the .NET stack that uses it under the covers?
It happens on different pages seemingly a random. Has anyone experienced this or can someone tell me what it is doing?
I know I can add this WSS to the directive, but I'd rather know what it is and why it is happening before I start making allowances for it.