Content Security Policy for Umami Cloud

[clemlatz]

Hi,

I've found that the domain called by the Umami analytics has changed several times recently, causing it to be blocked by my Content-Security-Policy header which originally only included https://analytics.umami.is/.

I've recently added https://api-gateway-eu.umami.dev/ only to discover today that the domain has changed again to https://api-gateway.umami.dev/, causing the script to be blocked again.

Is there a way to be warned about such changes or a place to get all domains that should be authorized?

Thanks,

Clément

[liamlaverty]

The list of recent urls required in connect-src is as follows:

• https://gateway.umami.is
• https://eu.umami.is
• https://api-gateway-eu.umami.dev
• https://api-gateway.umami.dev

I'm not sure if this is a comprehensive list. I'll come back to the post and edit it if I encounter another change.

[axadrn]

Should be part of the official documentation. @mikecao