Please document a minimal Content-Security-Policy required for using Spotlight

[lol768]

All of our applications use a strict CSP in both production and development, in line with security best practice.

At present:

Content-Security-Policy: The page's settings blocked the loading of a resource at http://localhost:8969/stream ("connect-src").

I assume it needs at least this connect-src whitelisted (is the port number deterministic?), because currently I just get Not connected to Sidecar

[lol768]

Answers: yes, port is always 8969 (but this can be configured)

connect-src was all it seemed to need in my set-up:

[dcramer]

For simple future context:

Content-Security-Policy: connect-src http://localhost:8969/

Agree we should add this to the docs. Not entirely sure the most straight forward location off the top of my head.

[BYK]

Closing as the embedded use case is now gone.