- Issue created by @jeffreysmattson
- 🇨🇦Canada gapple
I'm not familiar with Lottie files. How the files are loaded determine which CSP directive that corresponds to.
If you're hosting them on your website, your own CSP policy would not be relevant - the policy of the site loading them would control if they can access urls from your site.
If you're consuming them on your site from an external url and are unsure which directives are necessary to modify, you can set a restrictive Report Only policy such as just
default-src 'self', and then monitor the browser developer tools console for CSP violation messages which will tell you what directives were impacted.