Merge pull request #133 from alphagov/updating-CSP-for-new-HMRC-Webch…

…at-provider Updated CSP to for new HMRC & HMPO provider
alphagov · Feb 6, 2020 · e1f99f4 · e1f99f4
2 parents 2bb861d + 7c1670b
commit e1f99f4
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/lib/govuk_app_config/govuk_content_security_policy.rb b/lib/govuk_app_config/govuk_content_security_policy.rb
@@ -65,6 +65,10 @@ def self.build_policy(policy)
                        *GOOGLE_ANALYTICS_DOMAINS,
                        # Allow connecting to web chat from HMRC contact pages
                        "www.tax.service.gov.uk",
+                       # Allow JSON call to Nuance - HMRC web chat provider
+                       "hmrc-uk.digital.nuance.com",
+                       # Allow JSON call to klick2contact - HMPO web chat provider
+                       "gov.klick2contact.com",
                        # Allow connecting to Verify to check whether the user is logged in
                        "www.signin.service.gov.uk"