Summary

We are trying to run our first A/B test with VWO and are running into a Content Security Policy violation. They said we need to add VWO to our allow list.

 h3. Requirements

• Add an exception for VWO resources to our CSP headers
• Potentially use our own hook to add this, in order to keep the default CSP code clean.
• Add a feature flag to conditionally apply the CSP exceptions

Resources

• VWO CSP documentation
• Suggested CSP option by VWO:

  *default-src * 'self' data: 'unsafe-inline' 'unsafe-eval' blob: *.visualwebsiteoptimizer.com *visualwebsiteoptimizer.com app.vwo.com useruploads.vwo.io frame-ancestors 'self'
  

• A/B testing example page (see CSP errors in console log)