Why is confluence "cross site scripting"?

[NCarmichael]

We occasionally get performance issue in confluence cloud, despite being in a big European city with fibre internet connections.

Whilst experiencing it this morning I opened the browser dev console and could see the content taking time to load (over 10 seconds each despite just being small pieces of javascript) was outside of our normal *.atalasian.net domain (following redirects from *.atlassian.net addresses) to servers such as cc-fe-bifrost.prod-east.frontend.public.atl-paas.net (which in turn is a cname of a cdn server belonging to cloudfront and hosted by amazon in the same city as us)

So my questions are

• Given cross-site scripting is frowned upon now, why is confluence doing it (or at least using cnames to disguise the fact) 
•  why might there be poor performance downloading tiny little pieces of javascript (excluding lazy-loading used so socket activity)?

[vikram]

Hi @NCarmichael 

If you have paid subscription, its better raise a support ticket from below url so that Atlassian Team can check quickly and do the needful to get quick fix.

https://support.atlassian.com/

Vikram P

[NCarmichael]

Hi @vikram 

I thought as it affected us all it might be better in a public forum, my company for example (like many others) are going through the process of really "nailing down" our systems to be able to comply with US (soc 2) and European security standards and it is possible in that process we'll "break" our Jira instance if, for example we implemented a browser policy that prevented CSS

Also, I am sure I am not the first to notice this so thought I'd draw on everyone's previous experiences.

Neil