From f5e3ad56c7b2a31f0498844b0bab1cbf95e259e0 Mon Sep 17 00:00:00 2001
From: Ryan Ahearn <ryan.ahearn@gsa.gov>
Date: Mon, 23 Jan 2023 10:10:22 -0500
Subject: [PATCH] Add newrelic to browser CSP directives

---
 app/__init__.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/app/__init__.py b/app/__init__.py
index 9bf79ed2d..185d48aef 100644
--- a/app/__init__.py
+++ b/app/__init__.py
@@ -356,8 +356,8 @@ def useful_headers_after_request(response):
     response.headers.add('X-XSS-Protection', '1; mode=block')
     response.headers.add('Content-Security-Policy', (
         "default-src 'self' {asset_domain} 'unsafe-inline';"
-        "script-src 'self' {asset_domain} *.google-analytics.com 'unsafe-inline' 'unsafe-eval' data:;"
-        "connect-src 'self' *.google-analytics.com;"
+        "script-src 'self' {asset_domain} *.google-analytics.com https://js-agent.newrelic.com https://*.nr-data.net 'unsafe-inline' 'unsafe-eval' data:;"
+        "connect-src 'self' *.google-analytics.com https://*.nr-data.net;"
         "object-src 'self';"
         "font-src 'self' {asset_domain} data:;"
         "img-src 'self' {asset_domain} *.tile.openstreetmap.org *.google-analytics.com"