FortiOS 7.6.1 Content-Security-Policy Issue with WSS

[Mostafa85]

Hi everyone,

I'm encountering an issue with configuring Content-Security-Policy (CSP) in FortiOS 7.6.1. I'm trying to implement the following CSP rule:

default-src 'self' https://*.mydomain.net;
font-src 'self' https://fonts.gstatic.com data:;
style-src 'self' 'unsafe-inline' https://fonts.googleapis.com;
script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdn.jsdelivr.net;
img-src 'self' data: https:;
object-src 'none';
frame-ancestors 'none';

This configuration, however, blocks WebSocket (WSS) connections. To allow these, I attempted to add wss://*.mydomain.net to the default-src directive. However, the FortiOS validator throws the following error:In directive default-src, wss://*.mydomain.net is an invalid source.

I've tried various formats for including the wss:// scheme, but all resulted in the same validation error.

As a workaround, I've bypassed the validation and used this configuration:

default-src 'self' https://*.mydomain.net wss://*.mydomain.net;

This configuration does seem to work, allowing WSS connections.

My question is: Is this a bug in the FortiOS validation, or is it not possible to directly specify wss:// sources within the default-src directive using the validator?

Any insights or suggestions would be greatly appreciated.

Thanks!

[Anthony_E]

Hello Mostafa,

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.

Thanks,

[Jean-Philippe_P]

Hello,

We are still looking for an answer to your question.

We will come back to you ASAP.

Thanks,

[Anthony_E]

Hello Mostafa,

Could we please invite you to open a ticket with our TAC team: https://support.fortinet.com/welcome/

They will help you.

Regards,