Are you cloud-hosted and seeing CSP errors in your browser console about cloudfront.net

[NCarmichael]

We are cloud hosted and can see errors in the browser console about confluence (and others in the suite) trying to download content via Amazon's CDN "cloudfront"

The fix would be to added *.cloudfront.net" to the CSP declaration (this is described in the documentation of the self-hosted version as an admin option)  so I did raise it as a ticket with Atlassian but after months of back and forth with their 1st line support (who wouldn't escalate) I gave up!

Does anyone else see the issue? In the browser console we get messages like

Loading the font 'https://dayak6fulr4vl.cloudfront.net/mycompanynameredacted.atlassian.net/wiki/s/7.10.6/_/download/resources/com.atlassian.auiplugin:internal-iconfont-v2/fonts/adgs-icons.woff' violates the following Content Security Policy directive: "font-src 'self' *.public.atl-paas.net". The policy is report-only, so the violation has been logged but no further action has been taken.

We don't have a reverse proxy or anything else that would inject that so wondered if anyone else is experiencing the issue ?

It looks like it may be coming from Atlassian's use of "intercom" for support features, does anyone know if we can turn it off?

Apparently its an "ignorable" error but can help wondering if it causes a slight performance problem and I also find the idea of ignoring error problematic

ref:

https://support.atlassian.com/organization-administration/docs/ip-addresses-and-domains-for-atlassian-cloud-products/

[Ajay _view26_]

Hi @NCarmichael 

Yes, I've seen exactly this and you're right that it's an Atlassian-side CSP configuration issue on Cloud. The core problem is that Atlassian's Cloud infrastructure serves certain static assets (fonts, scripts, CSS) through Amazon CloudFront CDN, but their Content-Security-Policy header for your tenant only declares "font-src 'self' *.public.atl-paas.net" without including the CloudFront distribution domains.

[NCarmichael]

Thankyou, I tried to explain it everyway I could to Atlassian first line support and they wouldn't escalate to someone who understood the issue and how simple the fix could be!