Merge pull request #191 from alphagov/allow-lux-speedcurve

Allow LUX domain on img-src policy
alphagov · Mar 25, 2021 · 7a65e71 · 7a65e71
2 parents 6c03e1c + a8c34d4
commit 7a65e71
Showing 1 changed file with 4 additions and 1 deletion.
diff --git a/lib/govuk_app_config/govuk_content_security_policy.rb b/lib/govuk_app_config/govuk_content_security_policy.rb
@@ -32,7 +32,10 @@ def self.build_policy(policy)
                    *GOVUK_DOMAINS,
                    *GOOGLE_ANALYTICS_DOMAINS, # Tracking pixels
                    # Some content still links to an old domain we used to use
-                   "assets.digital.cabinet-office.gov.uk"
+                   "assets.digital.cabinet-office.gov.uk",
+                   # Allow images to be loaded for Speedcurve's LUX - used for
+                   # getting real user metrics on GOV.UK
+                   "lux.speedcurve.com"
 
     # https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/script-src
     policy.script_src :self,