Maps CSP

Last modified: February 2, 2024

1 Introduction

The Maps widget requires access to a map provider (the exact provider is based on your configuration) in order to work. Below, you can see the allowlist domains you need to set up for each available provider.

2 Setup Information

2.1 Google Maps

You can enable allowlist CSP for Google Maps by including these domains:

1
2
3
4
5
6
7

script-src 'self' https: blob:;
img-src 'self' https://*.googleapis.com https://*.gstatic.com *.google.com *.googleusercontent.com data:;
frame-src *.google.com;
connect-src 'self' https://*.googleapis.com *.google.com https://*.gstatic.com data: blob:;
font-src https://fonts.gstatic.com;
style-src 'self' 'unsafe-inline' https://fonts.googleapis.com;
worker-src blob:;

2.2 OpenStreetMap

You can enable allowlist CSP for Open Street Maps by including these domains:

1
2

script-src 'self';
img-src 'self' https://*.tile.osm.org data:;

2.3 Mapbox

You can enable enable allowlist CSP for Mapbox by including these domains:

1
2
3
4

worker-src blob: ;
child-src blob: ;
img-src data: blob: ;
connect-src https://api.mapbox.com https://events.mapbox.com ;

2.4 HERE Maps

You can enable allowlist CSP for HERE Maps by including these domains:

1
2

script-src 'self';
img-src 'self' https://*.base.maps.cit.api.here.com data:;