Altering the CSP for the version of JSM Atlassian host

[NCarmichael]

I have a issue in JSM where some of the images and javascript library in use come from the CDN cloudfront but the that domain is not in CSP permissions file of the app so they get blocked and we get broken images and functionality.

This is covered in manual for people that self-host, but, we are hosted by Atlassian and don't seem to have access to the variable that would allow us to change that.

Has anyone come across this? 

This is the CSP they are using for us where you can see it does not include the needed *.cloudfront.com

frame-ancestors 'self' *.atlassian.net *.jira.com *.atl-paas.net *.atlassian.com trello.com bitbucket.org *.jiraalign.com;
report-uri https://web-security-reports.services.atlassian.com/csp-report/jira-frontend-bifrost;
report-to csp-default-endpoint

(I have raised a ticket with Atlassian with all the details and screenshots but the person that picked it up doesn't understand nor is escalating it so I have "hit a brick wall")

https://confluence.atlassian.com/conf84/use-a-cdn-with-atlassian-data-center-applications-1255449373.html

[Marc - Devoteam]

Hi @NCarmichael 

Cloudfront is mentioned in this KB document.

https://support.atlassian.com/organization-administration/docs/ip-addresses-and-domains-for-atlassian-cloud-products/ 

Or check in the Developer Community for answers or support.

Or as you mention that this is part of an app, reach out to the vendor of the app.

[NCarmichael]

Hi Marc, thanks for coming back, by app(s) I meant the Atlassian suite as that is there preferred name now.

We don't have a "restrictive firewall" as such (but do use a cloud VPN), the issue however seems to  be that the CSP list that defines what site the Atlassian apps can use does not always contain *.cloudfront.net (as defined as required by the document you kindly attached).

[Marc - Devoteam]

Hi @NCarmichael 

You could reach out to Atlassian Support

This to present your case, but googling reveals more apps with this related error.

Or see if there is a solution on the Developer Community

[NCarmichael]

Hi @Marc - Devoteam 

I do have a ticket, but it isn't progressing.

As a workaround I have been using browser plugin that will let me intercept and change the CSP but I shouldn't have to do that.

I was hoping by reaching out here others with the issue  may have advice, I do like the idea that requirement to use content from CloudFront may from (or because of) the plugins we have active but ideally I'd be working on tickets for my product not Atlassian's :-)

Thanks for your help so far, much appreciated.