Cloudron Forum

They were only being embedded for the staff on our Nextcloud, not for the public. And we did restrict to our internal domains and had the same issues. Just thought people should know that some apps don't work at all with CSP, causing these apps GUI to stop loading complely making it look like the app no longer works.

I don't see how this can be actually used for malicous action regarding the translations, since those are coming in a well-known format and from your server itself, so unless someone intercepts or changes that on the server, nothing much can happen (and if someone can do that, well there are other things one should be worried about) If there are serious concerns around a real security issue, would be great to have that explained if someone is aware.

@fbartels Thank you, that was it! In case anyone else finds this blog post, the updated instructions are here: https://docs.cloudron.io/apps/#custom-csp

This can be done via ContentSecurityPolicy and Cloudron supports this for all apps: https://cloudron.io/documentation/apps/#custom-csp