FortiOS 7.6.1 Content-Security-Policy Issue with WSS

Hi everyone,

I'm encountering an issue with configuring Content-Security-Policy (CSP) in FortiOS 7.6.1. I'm trying to implement the following CSP rule:

default-src 'self' https://*.mydomain.net; font-src 'self' https://fonts.gstatic.com data:; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdn.jsdelivr.net; img-src 'self' data: https:; object-src 'none'; frame-ancestors 'none';

This configuration, however, blocks WebSocket (WSS) connections. To allow these, I attempted to add wss://*.mydomain.net to the default-src directive. However, the FortiOS validator throws the following error:In directive default-src, wss://*.mydomain.net is an invalid source.

I've tried various formats for including the wss:// scheme, but all resulted in the same validation error.

As a workaround, I've bypassed the validation and used this configuration:

default-src 'self' https://*.mydomain.net wss://*.mydomain.net;

This configuration does seem to work, allowing WSS connections.

My question is: Is this a bug in the FortiOS validation, or is it not possible to directly specify wss:// sources within the default-src directive using the validator?

Any insights or suggestions would be greatly appreciated.

Thanks!