Altering the CSP for the version of JSM Atlassian host

Question

I have a issue in JSM where some of the images and javascript library in use come from the CDN cloudfront but the that domain is not in CSP permissions file of the app so they get blocked and we get broken images and functionality.

This is covered in manual for people that self-host, but, we are hosted by Atlassian and don't seem to have access to the variable that would allow us to change that.

Has anyone come across this?

This is the CSP they are using for us where you can see it does not include the needed *.cloudfront.com

frame-ancestors 'self' *.atlassian.net *.jira.com *.atl-paas.net *.atlassian.com trello.com bitbucket.org *.jiraalign.com;
report-uri https://web-security-reports.services.atlassian.com/csp-report/jira-frontend-bifrost;
report-to csp-default-endpoint

(I have raised a ticket with Atlassian with all the details and screenshots but the person that picked it up doesn't understand nor is escalating it so I have "hit a brick wall")

https://confluence.atlassian.com/conf84/use-a-cdn-with-atlassian-data-center-applications-1255449373.html

NCarmichael · Answer

Latest update, I haven't managed to get past 1st line yet to someone who understand CSP's and my requests/button-pushing for escalation gets ignored.

I even had a call with our account manager who gave the impression he couldn't change anything :-(

I have taken Marks suggestion and opened a conversation on the dev' channel too

https://community.developer.atlassian.com/t/how-can-we-alter-the-csp-in-the-cloud-version-of-jsm/95281

NCarmichael · Answer

Hi @Marc -Devoteam-

I do have a ticket, but it isn't progressing.

As a workaround I have been using browser plugin that will let me intercept and change the CSP but I shouldn't have to do that.

I was hoping by reaching out here others with the issue  may have advice, I do like the idea that requirement to use content from CloudFront may from (or because of) the plugins we have active but ideally I'd be working on tickets for my product not Atlassian's :-)

Thanks for your help so far, much appreciated.

Marc -Devoteam- · Answer

Hi @NCarmichael

You could reach out to Atlassian Support

This to present your case, but googling reveals more apps with this related error.

Or see if there is a solution on the Developer Community