Using the JavaScript API with content security policies - Amazon WAF, Amazon Firewall Manager, and Amazon Shield Advanced
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Using the JavaScript API with content security policies

If you apply content security policies (CSP) to your resources, for your JavaScript implementation to work, you need to allowlist the Amazon WAF apex domain awswaf.com. The JavaScript SDKs make calls to different Amazon WAF endpoints, so allowlisting this domain provides the permissions that the SDKs need to operate.

The following shows an example configuration to allowlist the Amazon WAF apex domain: 

connect-src 'self' https://*.awswaf.com;
script-src 'self' https://*.awswaf.com;
script-src-elem 'self' https://*.awswaf.com;

If you try to use the JavaScript SDKs with resources that use CSP, and you haven't allowlisted the Amazon WAF domain, you'll receive errors like the following: 

Refused to load the script ...awswaf.com/<> because it violates the following Content Security Policy directive: “script-src ‘self’