'As per CSP, can an allowed JavaScript code run another JavaScript code downloading from different domain on a Web page?
I have a JavaScript code snippet embedded inline on a page that downloads and appends to body my main JavaScript code from a different CDN, cdnjs.com/xyz/main.js. So far this has worked fine for my customers. main.js is able to make AJAX calls and perform normally.
Is my assumption correct that clients must have allowed in their CSP policy the
cdnjs.comdomain? And this process is a required for a setup like mine?If I change my main JavaScript to additionally download and run new JavaScript code from another domain,
cdnjs2.com/abc/new.js, will this new JavaScript code run fine and be able to make AJAX calls?
Sources
This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.
Source: Stack Overflow
| Solution | Source |
|---|